I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an activation token.
However, the application has a bug currently, where the DB was set up with the password field NOT NULL, and without default value, which makes INSERTs fail.
If I modify my table structure and set a default value for the password (using some arbitrary encrypted value), admins can add new users and these users are prompted to set a password prior to first login.
My question is - is there a security risk here that I should be aware of?