fixed login vulnerability