This vulnerability (CWE-306) in Apache Answer versions prior to 2.0.2 is caused by insufficient verification of data authenticity during the external-login email binding process. Specifically, the lack of an authorization check enables unauthenticated attackers to hijack user accounts by exploiting crafted confirmation links. The flaw allows account takeover without requiring user interaction beyond clicking the malicious link. The vendor has addressed this issue in Apache Answer version 2.0.2.

An attacker can take over arbitrary user accounts without authentication by exploiting the missing authorization check in the email binding flow. This compromises user account integrity and could lead to unauthorized access to user data or actions performed on behalf of the victim. There is no indication of confidentiality or availability impact beyond account takeover.

Users should upgrade Apache Answer to version 2.0.2 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated.