Sometimes administrators suppress reporting errors with php directive error_reporting 0 .
Quite often it's done in .htaccess with line "php_value error_reporting 0"

But this directive disables trigger_error () function, which is used in verify.php

<code>
if ( $f_confirm_hash != $t_calculated_confirm_hash ) {
trigger_error( ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID, ERROR );
}
</code>

So it's possible to get logged in with url like this :

http://domain.name/verify.php?id=NNN&confirm_hash=MMM

where NNN - ID of any active user
MMM - any string

I believe this part of code should be changed.