Authentication failures come in many shapes. The verifier doesn't rate-limit; registration accepts any password; error messages reveal who exists.
Registration with no policy. Length 1 is accepted; the empty string is accepted; every breached password from haveibeenpwned is accepted.
USERS[u] = md5(p) # no length, no complexity, no breach-list check
Use a, password, or even an empty string.
The page reports the length; the server treats it as fine.