product does not properly implement a security-related configuration setting, allowing authentication bypass.
CVE-2009-2422
authentication routine returns "nil" instead of "false" in some situations, allowing authentication bypass using an invalid username.
CVE-2009-3232