Summary
The password reset functionality at https:
During testing, multiple password reset emails were requested for the same account. Even after receiving several newer password reset emails, an older reset link remained valid and successfully allowed password modification.
This indicates that multiple active password reset tokens exist simultaneously for a single account.
Affected URLs
https:
https:
Technical Description
Each password reset request generates a new password reset email containing a unique reset token.
A secure implementation should invalidate all previously issued reset tokens once a new password reset request is generated, ensuring that only the most recent token can be used.
However, testing revealed that previously issued reset tokens remain valid even after additional reset requests are generated. This allows multiple active password reset links for the same account.
This increases the attack surface if an older reset email is accessed by an attacker through email compromise, forwarding rules, or leaked mailbox backups.
Steps to Reproduce
Navigate to:
https:
Request a password reset.
Receive the first password reset email.
Without using the first reset link, request password reset several more times (e.g., 4–5 requests).
Observe that multiple password reset emails are received.
Open one of the older password reset emails.
Click the older reset link.
Reset the account password.
Observe that the password is successfully changed using an older reset token.
Working Proof of Concept
Affected Endpoint
https:
Example Reset URL
https:
Observed Result
Multiple password reset emails are generated.
Older password reset links remain valid after newer reset requests.
The older token successfully resets the account password.
Expected Result
Generating a new password reset request should immediately invalidate all previously issued reset tokens.
Only the most recently generated reset token should remain valid.
Evidence
During testing:
Multiple password reset emails were generated for the same account.
Four additional reset emails were requested after the initial email.
An older password reset link remained valid and successfully reset the password.
The attached screenshot shows multiple password reset emails received within a short period, demonstrating that numerous active reset links were generated.
Attack Scenario
An attacker gains temporary access to a victim's mailbox or obtains an older password reset email.
Even if the legitimate user later requests another password reset believing the previous link is no longer usable, the attacker can still use the older reset link to change the account password if it remains valid.
This extends the attack window and increases the likelihood of account compromise.
User Impact
Increased risk of account takeover.
Older password reset emails remain exploitable.
Users may falsely assume previous reset links have been invalidated.
Reduced security of the password recovery process.
Business Impact
Increased likelihood of unauthorized account access.
Weak password reset lifecycle management.
Loss of user trust.
Potential exposure of sensitive user data.
Non-compliance with secure authentication best practices.
Remediation
Invalidate all previously issued password reset tokens immediately after generating a new reset request.
Ensure only one active password reset token exists per account.
Expire unused reset tokens after a short duration (e.g., 15–30 minutes).
Mark reset tokens as single-use and invalidate them immediately after successful password reset.
Log and monitor excessive password reset requests for abuse.
References
OWASP Forgot Password Cheat Sheet
OWASP Authentication Cheat Sheet
NIST SP 800-63B Digital Identity Guidelines