The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.