Lab: Exploiting time-sensitive vulnerabilities
Summary: PortSwigger's lab walks through a password reset mechanism whose token is built from a timestamp rather than a race condition, so sending two reset requests in parallel from separate sessions can produce identical tokens. By changing the username parameter in one request to carlos, the lab shows both users receive the same token, and the attacker resets Carlos's password and logs in as him.
Bottom line: The token's predictability rests on a timestamp being one of the hash inputs, so anyone who can align two reset requests and knows the other inputs can mint a valid token for another account. The lab's final step is a full account takeover of carlos using only a reset link and a changed username parameter.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026