In JetBrains TeamCity prior to 2020.2.3, account takeover was potentially possible during a password reset.