The vulnerability arises from the lack of input validation when modifying user attributes, specifically the user ID. An attacker with manager or admin privileges can exploit this by setting a user's ID to 0, which the system then fails to recognize as a valid ID. This results in the account being inaccessible, as subsequent login attempts generate a valid token that is not accepted by any other API endpoints due to the system's token validation logic incorrectly handling an ID of 0.

An attacker with administrative or managerial access logs into the application and sends a modified request to change a target user's ID to 0. When the victim user attempts to log in, they receive a valid token but are unable to use it for further actions within the application, effectively denying them access to their account.

This vulnerability affects any user account whose ID can be manipulated by an attacker with administrative or managerial privileges. The denial of service impacts the account's accessibility, preventing the legitimate user from accessing their account.