User passwords can be set to expire after n days via configuration files.  If a user attempts to log in n days after their last password change then the applications should prevent them and show a message that the password has expired.  The WebUI does this, but in versions v5.4.0.8 and earlier and v6.0.0.0 the desktop application does not.  The user is able to log in regardless of their password having expired.

This issue will be fixed in v5.4.0.9 and 6.0.1.