Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.