1. Executive Summary & Scope
Password reset and account recovery flows represent one of the highest-value targets for attackers. Flaws in state transitions—such as allowing step 3 (reset password) to execute without completing step 2 (verify SMS code), or issuing reset tokens that fail to invalidate upon usage—permit complete account takeovers.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-640 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
An attacker manipulates hidden form fields, reuses historical reset tokens, or exploits session desynchronization to change passwords on victim accounts without knowledge of previous credentials.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Token is not invalidated after password change
function resetPassword($token, $newPassword) {
$user = findUserByToken($token);
$user->password = hashPassword($newPassword);
$user->save();
// Insecure: Reset token remains valid in database and can be replayed!
}
Hardened Defense-in-Depth Implementation
// REMEDIATED: Single-use cryptographic token with immediate invalidation
function resetPassword(string $token, string $newPassword, PDO $pdo): bool {
$tokenHash = hash('sha256', $token); // Store and compare token hashes
$pdo->beginTransaction();
$stmt = $pdo->prepare("
SELECT id, email, token_expires_at
FROM users
WHERE reset_token_hash = ? AND reset_token_used = 0 AND token_expires_at > NOW()
FOR UPDATE
");
$stmt->execute([$tokenHash]);
$user = $stmt->fetch();
if (!$user) {
$pdo->rollBack();
return false;
}
// Invalidate token immediately and rotate password
$newHash = password_hash($newPassword, PASSWORD_ARGON2ID);
$update = $pdo->prepare("
UPDATE users
SET password_hash = ?, reset_token_used = 1, reset_token_hash = NULL, session_version = session_version + 1
WHERE id = ?
");
$update->execute([$newHash, $user['id']]);
$pdo->commit();
return true;
}
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Token Replay Verification | Attempt to submit identical password reset token two times consecutively. | Second attempt is immediately rejected with invalid token error. |
| Session Invalidation Verification | Verify that changing the password immediately terminates all existing active web and mobile sessions. | Existing session cookies are completely invalidated. |
| Enumeration Resistance | Submit password reset request for existing vs non-existent email addresses. | Response message, HTTP code, and response latency are identical, preventing user enumeration. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.