In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
CWE-74, CWE-640