Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)

How it was found

Hi,

Hope you are good!

Steps to repro:

1. Create a HackerOne account having email address "[email protected]".
2. Now Logout and ask for password reset link. Don't use the password reset link.
3. Login using the same password back and update your email address to "[email protected]" and verify the same.
4. Now logout and use the password reset link which was mailed to "[email protected]" in step 2.
5. Password will be changed.

All previous password reset links should automatically expire once a user changes his email address. Please let me know if this can be fixed.

Best Regards Anand Prakash