Forgot password link doesn't expire after used, only after some hours
身份认证 / Weak Password Recovery Mechanism for Forgotten Password / #244642
该报告还没有中文解读。
原文摘录
摘自原文（1774 字符中的一小部分）
Hi, Hope you guys are doing great. I want to report couple of issues regarding forgot password mechanism. 1st ISSUE: One thing I noticed that when password rest link is requested and user change its password, that reset link should expire immediately but in your case , used reset link can be reused …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 WakaTime 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @mohammad_obaid · 版权归作者与 WakaTime 所有