Security: logAttempt succeeds if the password is of the first user in the users table

[AfzalivE]

Using the UserController supplied with Confide, the do_login function looks like this:

If I use something like TamperMonkey or Postman to submit a form that only has the following field with the corresponding value, no username or email field:

password  = "password_of_the_first_user_in_the_users_table"

It actually logs in. I have verified this on two of my projects. Can anyone confirm this behaviour?

[AfzalivE]

So, this was happening because the $identity_columns is empty after array_diff since there are no fields besides password.