Enforce expiry check on password reset token submission
fix: enforce expiry check on password reset token submission (#4545)
Enforce expiry check on password reset token submission280305-fix-enforce-expiry-check-on-password-reset-cve-2026-39923fixenforce expiry check password reset token
Committed by imorland
commit message
fix: enforce expiry check on password reset token submission (#4545)
POST /reset accepted any token present in the database without checking
whether it had expired, while GET /reset/{token} correctly enforced the
24-hour window. An attacker with access to a stale token (e.g. from a
leaked email or DB backup) could use it indefinitely.
Adds a `validOrFail` scope to `PasswordToken` matching the existing
pattern on `EmailToken`, and updates `SavePasswordController` to use it.Editor assessment
This commit patches CVE-2026-39923. The subject, fix: enforce expiry check on password reset token submission, is precise and imperative, and the parenthesized PR reference is a harmless pointer rather than ticket clutter. The body explains the asymmetry that created the flaw: POST /reset accepted any stored token while GET /reset/{token} enforced the 24-hour window, so a stale token from a leaked email or database backup stayed valid indefinitely. It then names the concrete remedy, adding a validOrFail scope to PasswordToken to mirror EmailToken and switching SavePasswordController to it. That combination of impact, root cause, and implementation detail makes it a strong example.