Dues to the dangers of SQL Column Truncation and some development flaws, WordPress has released WordPress 2.6.2 to work around the issues.

Upgrading to the latest release is important for those WordPress sites which allow open registration. It was possible apparently in version 2.6.1 and earlier versions to, according to the official statement, "craft a username such that it will allow resetting another user's password to a randomly generate password." While the password would not be disclosed to the attacker, it's not neccessarily a security issue, but better to be safe than sorry - so upgrade soon to 2.6.2.