Password Reset Vulnerabilities

Detects insecure password reset implementations including predictable tokens, missing expiration, and host header injection in reset links.

zakirkun Updated

File contents

Password Reset Vulnerabilities

Overview

Password reset flows contain numerous potential vulnerabilities:

  1. Predictable tokens: Reset tokens generated with Math.random() instead of CSPRNG
  2. No expiration: Tokens valid indefinitely, allowing long-lived account takeover
  3. Host header injection: Reset URL generated from Host header (phishing)
  4. Token reuse: Token remains valid after use
  5. User enumeration: Different responses for valid vs invalid email

Remediation

  • Use cryptographically random tokens (32+ bytes)
  • Expire tokens after 15-60 minutes and after first use
  • Generate reset URL from server configuration, not Host header
  • Return the same response regardless of email existence

zakirkun/ice-tea/tree/main/skills/auth/password-reset-flaws commit 6030014efa

Frequently asked questions

npx skillmds@latest add zakirkun/password-reset-vulnerabilities