Vendor
Lagarto Chivato versions 0.4.1 and earlier are vulnerable to pre-account hijacking, allowing unauthenticated attackers to take over arbitrary accounts by registering accounts with specific email addresses.