Product
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters, which allows unauthenticated attackers to log out users and clear local stores.