Weblate · Report #243594
Reset password more than once with a reset link
Validstatus
8upvotes
21 Aug 2017disclosed
How it was found
Hi,
Though passwords reset links cannot be used more than once but I found a case where one could do so.
Reproduction Steps
- Request a Password Reset on demo.weblate.org
- Click the reset link in email
- Enter a new password
- Click
Set my password - Then you'll be redirected to the login page
- Click
reset itagain - Fill the email and the captcha
- Click
Reset my Password - Instead of a message to check mail, you'll be prompted with the
Password Reset form - Enter a new password and set it
- Password successfully changed again
- Repeat from 6
Shuaib