Summary:
When a user clicks on forgot password and requests a password reset link, that password reset link is not expiring after the user has changed the password in the settings page.
i.e. Suppose I am not able to recall my password so I requested a password reset link, in the meanwhile I remembered my password and logged into my account and changed my
password from settings successfully. Now the password reset link should be expired but even after changing the password from settings page I was able to set a new password from
the reset password link.
Steps to Reproduce:
1. Visit www.amplenote.com and request a password reset link from forgot password option.
2. Don't use the link and login with the correct credentials.
3. Now change the password from my profile section.
4. Once the password is changed visit the old password reset link.
5. You will observe that the link is still working. It should expire immediately once the password is changed from anywhere.
Impact:
The attacker can still change the password if the victim thinks his/her account is compromised and decided to change his/her password from profile section.
i.e. Any external attacker can use the unused token to reset victim tokens.