Lab: Password reset broken logic
Summary: PortSwigger's Web Security Academy lab shows a password reset flow where the reset token is passed as a URL query parameter and included in the POST /forgot-password request, but the server never checks it when the new password is submitted. Deleting the token value in both the URL and request body still lets the reset succeed, so changing the hidden username parameter to carlos and setting a new password takes over his account.
What's compelling: A reset token that is issued but never verified means anyone who can reach the reset endpoint can set another user's password by editing a single hidden field - here, the victim's username is carlos, and no token is required to complete the change.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026