Fider

Fider versions before 0.34.0 are vulnerable to Server-Side Request Forgery (SSRF) in the webhook functionality, allowing authenticated administrators to perform unauthorized requests against internal network resources.

Fider versions prior to 0.36.0, when configured in multi-tenant mode, allow attackers to leverage an email verification key from one tenant to authenticate as that user on another, resulting in cross-tenant account takeover.