The invitation controller fails to stop processing after redirecting when it encounters invalid input, such as a missing hash or users that are non-existent, disabled, or deleted. This allows an unauthenticated attacker to re-enable and set a new password for any existing frontend user account.