CVE-2026-65840

Name of the Vulnerable Software and Affected Versions Fider versions prior to 0.36.0

Description In multi-tenant mode (HOST MODE=multi), a flaw exists where an attacker can use an email verification key issued by one tenant to authenticate as the same email address on a different tenant. This occurs due to a missing tenant identifier filter in the getVerificationByKey() function, which allows for a complete bypass of tenant isolation and unauthorized account takeover across tenants. Single-host deployments (HOST MODE=single) are not affected.

Recommendations Update to version 0.36.0.