The function auth_generate_confirm_hash() is used in verify.php to allow a passwordless login during signup, lost password or reset password procedures.

the hash is produced by:
<code>
function auth_generate_confirm_hash( $p_user_id ) {
$t_confirm_hash_generator = config_get( 'password_confirm_hash_magic_string' );
$t_password = user_get_field( $p_user_id, 'password' );
$t_last_visit = user_get_field( $p_user_id, 'last_visit' );

    $t_confirm_hash = md5( $t_confirm_hash_generator . $t_password . $t_last_visit );

    return $t_confirm_hash;
}

</code>

If the admin did not set password_confirm_hash_magic_string and the LDAP login is used (so no passwords are set) the hash is somewhat more predictable.

I propose to replace $t_confirm_hash_generator with something less predictable; the user's cookie string looks like a very good candidate