Contao prior to 3.5.39 and 4.x prior to 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
contao contao cms