Security Bug

following code contains a bug. Anyone interested to identify it.


protected bool Authenticate(string userName, string password)
{
MembershipProvider = membershipProvider = new Membership.Provider;

byte loginAttempt = (byte)Session["loginAttempt"];

if(loginAttempt < 3 && membershipProvider.ValidateUser(userName,password))
{
Session[LoginAttempt] = 0;
return true;
}


loginAttempt++;
Session["loginAttempt"] = loginAttempt;
return false;

}