Overly basically, it’s a file based way to prove you can log into an account

There is information in file that the computer can verify that you created the certificate on this computer while already having access to this account, therefore you are allowed access.

In most contexts, digital certificates are considered more secure than a password for authentication, so in creating one, it’s a pretty typical thing to disable being able to log in with a password. However, this bug allows account access with a garbage password.