The login link doesnt work on last WP version
You can log in on anybodys account if they haven’t set up a qr code yet with
https://yoursite.com/wp-login.php?user_id=1&qr_code=&
You should validate data better.