Predictable & Leaked Reset Tokens

A password-reset token is a bearer credential. If it is predictable or leaks, anyone holding it can take over the account.

How it works

• Predictable generation: tokens seeded from time(), an incrementing ID, a username hash, or a non-cryptographic RNG can be reproduced offline. If two resets a second apart yield adjacent tokens, the space is tiny.
• Leakage: tokens placed in the URL leak via the Referer header to third-party scripts, via shared links, browser history, proxy logs, and analytics.
• No invalidation: tokens that don't expire, aren't single-use, or survive after the email changes widen the window.

How to test

Request several resets and compare tokens for structure or sequence. Check whether the token appears in Referer to external origins, whether it is reusable, and whether it expires.

Impact

Account takeover by predicting or replaying a reset token.

Defenses

• Generate tokens from a CSPRNG with ≥ 128 bits of entropy.
• Make them single-use and short-lived; invalidate on use, on password change, and on a new request.
• Avoid putting secrets in URLs where the Referer can leak them.