Product
Fider versions prior to 0.36.0, when configured in multi-tenant mode, allow attackers to leverage an email verification key from one tenant to authenticate as that user on another, resulting in cross-tenant account takeover.