the attacker types a URL to a page beyond the login screen when the login screen appears.
If the application is not program correctly, the bypass will work, giving an unauthenticated user access to information that should only be accessed by authenticated user.