    function showAddBypassForm() {
        $output = $this->pageContext->getOutput();
        $request = $this->pageContext->getRequest();
        
        $output->addHTML(
            new OOUI\FormLayout([
                'action' => SpecialPage::getTitleFor('ConfirmAccounts', wfMessage('scratch-confirmaccount-requirements-bypasses-url')->text())->getFullURL(),
                'method' => 'post',
                'items' => [
                    new OOUI\ActionFieldLayout(
                        new OOUI\TextInputWidget( [
                            'name' => 'bypassAddUsername',
                            'required' => true,
                            'value' => $request->getText('username')
                        ] ),
                        new OOUI\ButtonInputWidget([
                            'type' => 'submit',
                            'flags' => ['primary', 'progressive'],
                            'label' => wfMessage('scratch-confirmaccount-requirements-bypasses-add')->parse()
                        ])
                    )
                ],
            ])
        );
    }

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.