Local authentication bypass via patched password return

Authentication bypass in Reolink desktop application 8.18.12 allows local users to unlock its interface by modifying a resource file. The get_settings_lock_screen_password handler in an unpacked Electron JavaScript bundle returns a.settingsManager.lockScreenPassword, and changing that return value to an empty string disables the password prompt. Exploitation requires filesystem access to alter the installed application; Reolink disputes the issue because the local user modifies the user's own instance, and the demonstrated consequence is access to the application's interface and settings.