Insecure Password Recovery
Flawed password recovery mechanisms can allow attackers to reset other users' passwords, enumerate valid accounts, or gain unauthorized access through predictable reset tokens, insecure questions, or email-based vulnerabilities.
Overview
Password recovery and reset flows are critical security functions that are frequently implemented insecurely. Common weaknesses include predictable reset tokens, lack of expiration, user enumeration through different error messages, and reliance on insecure "security questions" that can be easily researched.
Impact
Account takeover, user enumeration, unauthorized access to password reset flows.
Remediation
Use cryptographically random reset tokens with short expiration, implement rate limiting, avoid security questions, send generic error messages, and require identity verification.
Use cryptographically secure random tokens for password resets
Enforce short expiration times (15-30 minutes)
Return identical responses for valid and invalid emails
Implement rate limiting on the reset endpoint
Send password reset links over HTTPS only
Invalidate reset tokens after single use
Related SuperClue scanner checks
These scanner checks look for signs of Insecure Password Recovery. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works