Vulnerabilities in other authentication mechanisms
Summary: PortSwigger's research notes that account-management features beyond the login page - "remember me" cookies, password reset, and password change - often carry the same vulnerabilities sites guard against at login. It describes predictable cookie construction from static values like username and timestamp, reset URLs with guessable parameters, and reset forms that fail to re-validate the token on submission. The text also covers password reset poisoning, where a dynamically generated reset URL lets an attacker steal another user's token, and password change pages that accept a username in a hidden field.
Why it matters: An attacker who can create their own account can study their own "remember me" cookie or reset flow and work out the formula, then brute-force other users' cookies or reset tokens - and cookie guessing may bypass the login attempt limits that protect the login page.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026