A flaw in Microsoft's ASP.net potentially allows intrudes to bypass the password requirement. This is for every version of ASP.net for entire article..
ASP.NET Security Flaw Exposed - EVERY VERSION - No Password Required
ASP.NET Security Flaw Exposed - EVERY VERSION - No Password Required