Indeed it is an open security hole. See my other comment.