Password Reset Vulnerabilities
Overview
Password reset flows contain numerous potential vulnerabilities:
- Predictable tokens: Reset tokens generated with Math.random() instead of CSPRNG
- No expiration: Tokens valid indefinitely, allowing long-lived account takeover
- Host header injection: Reset URL generated from Host header (phishing)
- Token reuse: Token remains valid after use
- User enumeration: Different responses for valid vs invalid email
Remediation
- Use cryptographically random tokens (32+ bytes)
- Expire tokens after 15-60 minutes and after first use
- Generate reset URL from server configuration, not Host header
- Return the same response regardless of email existence