Lago (<= 1.55.0)

Lago versions through 1.55.0 contain an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check.