HackerOne Bug Bounty Disclosure: user-can-bypass-password-enforcement-when-federated-sharing-is-enabledbymichag86