Uefa bears "primary responsibility" for the chaotic scenes that "almost led to disaster" before last year's Champions League final between Liverpool and Real Madrid, says an independent report.
Fans were penned in and teargassed outside Paris's Stade de France as kick-off was delayed by 36 minutes.
"It is remarkable no one lost their life," said the report, which Uefa commissioned after the 28 May final.
Uefa and French authorities initially blamed ticketless fans for the events.
The report says there is "no evidence" to support the "reprehensible" claims.
"The panel has concluded that Uefa, as event owner, bears primary responsibility for failures which almost led to disaster," said the report.
"All the stakeholders interviewed by the panel have agreed that this situation was a near-miss: a term used when an event almost turns into a mass fatality catastrophe."
While it said there was "contributory fault" from other bodies - particularly French police and the French Football Federation - the findings said European governing body Uefa was "at the wheel".
"Uefa should have retained a monitoring and oversight role [of security], to ensure it all worked. It self-evidently did not," the report added.
What else did the report find?
Uefa commissioned the independent report three days after the match - the showpiece of European club football which Liverpool went on to lose 1-0 - took place in the French capital.
The European governing body said a "comprehensive review" would examine a number of factors that include the decision-making, responsibility and behaviour of all parties involved in the final.
The investigation found eight key factors that "almost led to disaster" because of Uefa's failure, which included:
- a disproportionately large number of Liverpool supporters being directed to the Stade de France Saint-Denis train station
- poor route planning between the train station and the stadium
- inadequate ticketing systems and entry mechanisms at the additional security perimeters
- large groups of locals gaining entry to the stadium and a failure to police them
- police using tear gas and pepper spray in the concourses
It also said the collective action of Liverpool supporters was "probably instrumental" in preventing "more serious injuries and deaths" outside the stadium.
The investigation was chaired by Dr Tiago Brandao Rodrigues, a Portuguese politician, with the panel also including experts and consultants from legal, policing and event-management fields, along with representatives from football fan groups.
"The enthusiasm around the game rapidly turned into a real 'near miss' which was harmful to a significant number of fans from both clubs," said Dr Rodrigues.
"This should never have happened at such an important sporting event, and it is unacceptable that it took place at the heart of the European continent."
The report made 21 recommendations in an attempt to ensure "everything possible is done" to prevent any similar incident happening again at a major sporting event.
It also warned French authorities this should be a "wake-up call" before it hosts the 2023 Rugby World Cup and 2024 Olympic and Paralympic Games.
Uefa apologises to Liverpool fans
For many Liverpool fans, the incident and subsequent attempted attribution of blame on supporters has evoked painful memories of the Hillsborough disaster.
Ninety-seven Liverpool supporters died as a result of the April 1989 disaster at Sheffield Wednesday's stadium, where fans were crushed because of overcrowding in the Leppings Lane End at an FA Cup semi-final against Nottingham Forest.
After years of smear campaigns, a new inquest concluded in 2016 the behaviour of Liverpool supporters played no part in the deaths and those who died were unlawfully killed.
The accusations made by Uefa and French authorities about alleged ticketless Liverpool fans in Paris were criticised by the Rodrigues-led report.
"The parallels between Hillsborough 1989 and Paris 2022 are palpable," it added.
"The similarities include the fact both events were preventable and both were caused by the failures of those responsible for public safety.
"Both events were foreseeable."
Following the publication of the review into the Paris scenes, Uefa apologised "most sincerely" for the events which unfolded.
Uefa said it would also announce a "special refund scheme" for affected fans.
"In particular, I would like to apologise to the supporters of Liverpool," Uefa general secretary Theodore Theodoridis said.
"For the experiences many of them had when attending the game and for the messages released prior to and during the game, which had the effect of unjustly blaming them for the situation leading to the delayed kick-off."
What have Liverpool and fans said?
Uefa initially aimed to publish the findings of the investigation by November last year.
The report was released on Monday, about an hour before Liverpool's home game against Merseyside rivals Everton.
Steve Rotheram, mayor of the Liverpool City Region, says the findings "vindicated" the Liverpool fans who had said Uefa and the French authorities were responsible for the events.
"Fans who travelled to Paris expecting the night of their lives were put in harm's way by the very people who are meant to protect them," Rotheram, who was at the match, said.
"The organisation before, during and after the game - and the heavy-handed treatment of fans - was predicated on flawed intelligence and the inaccurate preconceptions and prejudices of the authorities."
The findings were thought to be set for publication on Tuesday, but details of the investigation's conclusions were reported by a number of media organisations earlier on Monday.
Liverpool said they had not received a copy of the report before seeing the stories in the media.
"It's hugely disappointing that a report of such significance, such importance to football supporters' lives and future safety, should be leaked and published in this way," said the club.
Liverpool supporters' group Spirit of Shankly was also unhappy the report had been leaked before being seen by the club and their supporters.
"It's disappointing and insensitive to release a report of this magnitude without first releasing to supporters who were there," a spokesman told the BBC.
What happened outside the Stade de France?
Uefa initially blamed the "late arrival" of fans for the problems, which delayed kick-off by more than half an hour.
Many Liverpool fans said they had been at the stadium hours before kick-off - scheduled for 21:00 local time - but were stopped from getting into the ground.
The gates opened at 18:00 local time and fans had been told to arrive early to ease congestion.
Liverpool supporters arriving shortly after that time said already-large crowds were not moving through a ticket checkpoint and led to fans being crammed in underpasses outside the stadium.
Five minutes before kick-off, at 20:55, Uefa announced that the start of the match was delayed "for security reasons" until 21:15.
Eyewitnesses said the French police began to use pepper spray, causing the crowd to stampede backwards and leaving some of them vomiting as others rushed for water from neighbouring bars to ease the pain.
At 21:14 Uefa announced a further delay to kick-off. Eventually, the match began at 21:36.
France's interior and sports ministers acknowledged difficulties in managing crowds at the final but initially pointed blame at Liverpool fans and local youths trying to force their way into the stadium.
French sports minister Amelie Oudea-Castera said Liverpool had let their supporters "out in the wild", prompting Liverpool chairman Tom Werner to demand an apology for her comments.
Shortly after the final, a spokesperson for France's independent police commissioner's union (SICP), Mathieu Valet, told the BBC's Newshour that "supporters without tickets or with fake tickets were not the main problem".
He said it was down to "three or four hundred French and undocumented delinquents" who had gained access to the stadium's concourse.
"It's clear that we needed more police - we didn't have enough on the ground," he said.