The vulnerability would require an outsider to already have obtained a victim's username and password.