According to a post on 9to5Mac, an iOS bug allows for anyone to disable Find My iPhone and bypass Activation Lock without a password. The glitch requires some pretty nimble finger moves to pull off the hack, but a video accompanying the article illustrates that the stunt is possible.
The way the security features are intended to work require Find My iPhone to be disabled via the password for the Apple ID associated with the iCloud account.
However the bug allows someone to bypass that requirement by tapping both "delete account" and the switch to disable Find My iPhone at the same time in the iCloud settings panel.
When the prompt for a password shows up, quickly powering off the phone, restarting it and then returning to the iCloud settings panel allows the account to be removed without entering the password, according to the article.