Password reset token not expiring

How it was found

Old unused Password reset tokens are not expiring on mail.ru after the issuance of a new token. Explaination Suppose at 09:00 hrs I used password reset options of mavenlink and got a token on my email.Lets call it token01.But i didnot use it. And at 09:04 hrs I used again the password reset option and got a new token,which is token02. Now generally after the issuance of token02,the previous unused token should expire.But in case of mavenlink its not happening.Both the tokens are remaining usable at the same time.

Attack Scenario Suppose I am an attacker and I got access to the recovery email option of your mavenlink account.I logged in to ur recovery email (suppose that is [email protected]).Then I used the forget password option of your mavenlink email.I will get one password reset token. I noted the token and then deleted the email from [email protected]. In the meantime u understood that someone got access to ur account.They you reset the password of mavenlink by issuing new token and also u changed the password of ur [email protected] so that any one cant hack again ur mavenlink account. Now its time for my exploitation. I will use my token which is live even after your issuance of new token.and I will hack into ur mavenlink account.

Mitigation

1. Use a certain living span for a token.Suppose,a token will remain valid upto 12 hours after being issued.
2. All unused tokens should expire automatically after the issuance of a new token.