Vantage6 versions prior to 5.0.0 have an issue where the API routes for password/MFA reset do not limit the number of emails sent. This allows an attacker who knows a user's password to trigger many MFA reset emails, potentially flooding the user's mailbox and impacting the SMTP server. However, since resetting the MFA token requires the correct password, the overall risk is low. A fix is available in version 5.0.0.