A password reset that trusts the wrong field

Authentication proves who is making a request. A bypass is any path that reaches an authenticated state without presenting the secret that state is meant to require — a default credential, a flawed comparison, a token that is trusted when it should not be, a step in a flow that can be skipped.

This lab: A password reset that trusts the wrong field. Get past the login without the credential it is supposed to demand.

Work it against your own copy of the target. When you have the flag, submit it below.

Reach a page or an action that should require a valid login, without holding valid credentials. Capture the flag shown once you are through.