WakaTime: IDOR create accounts and verify them with original account email

Good evening, Vulnerability I'm able to create accounts with the email verification that originates from the first account I created. After changing the confirmemail request body to a different email.. After I use that verification link that account is now under my control and bypasses...