The hosted Login V1 UI contains a flaw where the change-username handler processes requests for the account associated with a login flow before verifying any authentication factors. This allows unauthenticated attackers to provide a victim's login name and submit a new username to rename any active human user, including administrators, which results in the users being locked out of their accounts.