Submitted by waldenyan20, also found by 0xRobocop, minhtrng, hansfriese, KIntern_NA, mert_eren, peanuts, cccz, and Ruhum
When the reward speed is changed in MultiRewardStaking, the new end time is calculated based off of the balance of the reward token owned by the contract. This, however, is not the same as the number of reward tokens that are left to be distributed since some of those tokens may be owed to users who have not collected their rewards yet. As a result, some users may benefit from earning rewards past the end of the intended reward period, and leaving the contract unable to pay the rewards it owes other users.
A simple Foundry test I wrote demonstrates that the contracts fail to calculate the rewards properly after the reward speed is changed:
The output of the test demonstrates an incorrect calculation:
Notice that the amount of reward tokens given to Bob is more than the amount owned by the contract!
I reproduced the bug simply by adding a test within the existing Foundry project.
There is a nice accounting trick to make sure the remaining time is calculated correctly without needing to keep track of how much you owe to users that has not been paid out yet. I would suggest changing the vulnerable code in changeRewardSpeed to:
RedVeil (Popcorn) confirmed, but disagreed with severity 
