Oh come on. Calling this an auth bypass when this requires using a hash algorithm that is not considered reasonable for password storage for several decades and when there is password_verify() in PHP's stdlib for almost 15 years is not helping anyone write better code.
