The affected asset is anonymised at the researcher's request.
Severity: Critical Type: Authentication Bypass / Account Takeover (ATO) CWE: CWE-640: Weak Password Recovery Mechanism for Forgotten Password CVSS 3.1: ~9.1 (Critical)
Summary During a routine check of the password reset process on auth.target.com, I found a serious vulnerability. This flaw lets an attacker reset the password of any user account without needing the corresponding OTP (One-Time Password). The main issue is the missing authorization check on the password validation endpoint. It trusts a user-controlled email parameter without confirming ownership of the active password reset session.
Attack Flow Step 1: Initiate Password Reset for Attacker-Controlled Account The attacker starts a password reset request for an email they control (e.g., attacker@example.com). The application sends an OTP to this address.