An authentication bypass exists in the Login V2 UI that allows unauthenticated attackers to take over accounts of users who have not yet configured any authentication method. By computing a valid `verificationCheck` cookie using the user ID and browser fingerprint, an attacker can set a password, register a passkey, or link an identity provider for the target account.