HexBrain

Weblate · Report #245450

Reset password more than once with a reset link #2

Validstatus
8upvotes
7 Oct 2017disclosed

How it was found

Sequel to the fix on #243594, this is still possible.

Reproduction Steps

  1. Request password reset

NOTE: I figured that if action is not performed after a few minutes, then this doesn't work.

I suggest you make the link expire after use than setting a time frame.

Best!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original