Vulnerability in the Login Form

How to reproduce:
1. Go to login form (http://drupalsite.com/user/)
2. Type the user and password fields (keep Captcha field empty)
3. ENTER
4. Error "The field What code is in the image? is needed."
5. No type the password and captcha field (Keep both empty)
6. ENTER
7. BOOM! The user login.

I have the only Image Captcha enabled.
My drupal version : 5.2
DB: MySQL

I think that also it is a drupal bug.

Bye and thanks.