A flaw in the software allows a brute force attack to be possible, even when the permanent lockout feature is enabled. This is due to an incorrect error message being displayed when incorrect credentials are entered, posing the highest threat to confidentiality.