HexBrain

Basecamp · Report #1288898

Password reset link not expiring after changing password in settings

Validstatus
lowseverity
$250bounty
49upvotes
10 Aug 2021disclosed

Summary

@blackbibin reported password reset link not expiring when password was updated from an active session, by going to the Account's Login & Security setting. We were only expiring password reset links when the password was updated through a password reset request. Now we expire password reset links whenever a password is updated (besides regular time-based expiration).

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original