Basecamp · Report #1288898
Password reset link not expiring after changing password in settings
Validstatus
lowseverity
$250bounty
49upvotes
10 Aug 2021disclosed
Summary
@blackbibin reported password reset link not expiring when password was updated from an active session, by going to the Account's Login & Security setting. We were only expiring password reset links when the password was updated through a password reset request. Now we expire password reset links whenever a password is updated (besides regular time-based expiration).
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.