Sure, having access to a supposedly controlplane (tier 0) server will have vulnerabilities like you mentioned. It would be good to mention that it is an improvement to user account+password which could be abused without having access to the server?