A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.
hackerone·CWE-840·Published 2020-10-05