Screen-sharing bug lets remote hackers log in without a password.