HackerOne · Report #38343
Issue with password change
Validstatus
$500bounty
5upvotes
28 May 2015disclosed
How it was found
When a password is changed in user's profile, then a notification about password change is sent to the user (email). This is good.
However, user not always gets a notification about password change - when a password is changed via password reset link, then such a notification is not send to the user.