Gladys Assistant versions before 5.1.0 have a vulnerability in the password reset functionality where the origin parameter is not validated server-side. This flaw allows unauthenticated attackers to craft malicious password reset links that leak valid reset tokens to the attacker. Exploiting this can lead to full account takeover, including administrator accounts.