≤ 0.13.1
Shynet before 0.14.0 allows Host header injection in the password reset flow.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.