The login exists, but a flaw lets the attacker get past it. The cause may be a path that was not protected, a check that can be fooled or a default that was left open. Once past it, the attacker acts as an authorized user, or as an administrator.
Bypasses are often scored lower than code execution flaws, but they are the doorway to everything behind the check. They are also a favorite first step in a chain, where the bypass reaches a function that then runs commands.
In October 2022, Fortinet disclosed CVE-2022-40684, an authentication bypass in the administrative interface of FortiOS and related products, which attackers used to take over devices.
Keep management interfaces off the public internet, allow access only from trusted addresses or through a VPN, add multi-factor authentication where the product supports it and treat a bypass as serious even when its score is modest.