Summary
The password reset functionality at https:
Allowing password reuse weakens account security by enabling users to continue using compromised or previously exposed passwords.
Affected URLs
https:
https:
Technical Description
During testing, a password reset token was generated using the Forgot Password functionality.
When the reset link was opened, the application accepted the account's existing (or previously used) password as the new password without enforcing any password history validation.
A secure password reset mechanism should prevent users from reusing their current password, and ideally prevent reuse of a configurable number of previous passwords.
Steps to Reproduce
Log in to an existing account.
Note the current account password.
Navigate to:
https:
Request a password reset.
Open the password reset email.
Visit the password reset link.
Enter the current (or previously used) password as the new password.
Submit the request.
Observe that the password reset succeeds.
Working Proof of Concept
Affected Endpoint
https:
Observed Result
The application accepts the existing or previously used password.
Password reset completes successfully.
Expected Result
The application should reject passwords that match the current password.
Optionally, it should reject recently used passwords based on the organization's password history policy.
Attack Scenario
If a user's password has been exposed in a previous data breach, the user may unknowingly reuse the same compromised password during password recovery.
An attacker already in possession of the compromised password could continue accessing the account if the password is reused, defeating the purpose of forcing a password reset.
User Impact
Users may continue using compromised passwords.
Reduced effectiveness of password reset as a security control.
Increased risk of repeated account compromise.
Business Impact
Weaker overall account security.
Increased likelihood of account takeover using previously compromised credentials.
Potential non-compliance with organizational password management policies.
Reduced user confidence in the platform's security.
Remediation
Prevent users from setting the same password as their current password.
Enforce password history by storing hashes of recent passwords and rejecting reuse (e.g., last 5–10 passwords).
Display a clear error message such as:
"Your new password must be different from your current or recently used passwords."
Continue enforcing strong password complexity requirements during password resets.
References
OWASP Authentication Cheat Sheet
OWASP Forgot Password Cheat Sheet
NIST SP 800-63B Digital Identity Guidelines