Resubmitted with POC #18685 Password reset CSRF

How it was found

Hey there I found out that an attacker can use the password reset link to forge requests because there is no CSRF token in that particular request to validate that request. You should always have a CSRF token in the password reset request.