Account Takeover with old password and login QR

Summary

BCM servers don't store users' passwords, and the private keys are stored locally. If you change the password, the data in the old QR code will not be revoked. Please read the warnings during registration and backup, and protect your account credentials. Thank you!

When someone wants to log into his account with QR then he has to provide the QR code along with account password. If an user changing his password, the QR code (Private Key) also changing after password change. But application is not invalidating old password and old QR code. Anyone can login with that old password and old QR code.