[flintcms] Account takeover due to blind MongoDB injection in password reset

I would like to report a privilege escalation vulnerability in flintcms. It allows to reset a known user password, extract its password reset token and reset its password to then access the account.

  router.get('/verify', async (req, res) => {
    const token = req.query.t

    const user = await User.findOne({ token })

    if (!user) {
      res.redirect('/admin')
      return
    }

    res.redirect(`/admin/sp/${token}`)
  })