contao
Changing the password should invalidate password reset tokens
Affected version(s)
all
Description
Vulnerability Name: Broken Authentication – Session Token bug
I found a broken authentication vuln
POC:
1- Create an account 2- Confirm your email 3- Now request a password reset. 4- Don’t use the password reset link that was sent to your email. 5- Login to your account, remember don’t use the reset password link you requested in 3 step 6- Change your password in the Account Settings 7. After you change your password inside your account, Check the reset password link you requested in Step 3 in your email. 8. Change your password using the reset password token you requested.
Impact token should expire If the site has a token issue, The result is the reset password token in Step 3 is still usable and has not expired yet. Not invalidating the session token for the reset password is not a good practice for a company.
