Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.
CWE-640