OpenCFP's third-party authentication framework, Sentry, has a vulnerability in versions prior to 2.1.7 where the password reset code defaults to NULL if no token is set. This flaw allows an attacker to manipulate any user's password if they can correlate user IDs with email addresses, potentially enabling account takeover. The vulnerability affects the reset password logic and is rated high severity.