In multi-tenant mode (`HOST MODE=multi`), a flaw exists where an attacker can use an email verification key issued by one tenant to authenticate as the same email address on a different tenant. This occurs due to a missing tenant identifier filter in the `getVerificationByKey()` function, which allows for a complete bypass of tenant isolation and unauthorized account takeover across tenants. Single-host deployments (`HOST MODE=single`) are not affected.