A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
CWE-640