The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.