A password reset link can be used to enter someone else's account
Insecure password reset token handling
What this means
The password recovery link is predictable, never expires, or works more than once. Whoever obtains or guesses it can sign in as that user.
Why it matters
Password recovery is a side door to every account. One weak link cancels out strong passwords and two-factor sign-in alike.
How to fix it
- Make reset links random and long, valid for no more than an hour.
- Invalidate the link immediately after first use and after any password change.
Prompt for your AI agent
Make password reset links single-use, random and short-lived. After a link is used it must stop working.
How to verify the fix: open a used recovery link a second time — expect a refusal
References: cwe.mitre.org