Project

General

Profile

Actions
Copy link

Defect #44673

open

"Lost password" function allows to set the same password again even if it was expired

Added by Jens Krämer 1 day ago. Updated 1 day ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Accounts / authentication
Target version:
6.1.6
Resolution:
Affected version:

Description

Users can bypass the forced password expiry (which prevents reuse of the same password) by using the lost password feature, which allows to set the same password again and resets the password age.

The attached patch closes that loophole.

Files

0001-Reject-the-current-password-on-lost-password-reset-w.patch (2.78 KB) 0001-Reject-the-current-password-on-lost-password-reset-w.patch Jens Krämer, 2026-10-26 05:31
Actions
Copy link
 #1

Updated by Go MAEDA 1 day ago

  • Tracker changed from Patch to Defect
  • Target version set to 6.1.6

Setting the target version to 6.1.6.

Actions
Copy link

Also available in: Atom PDF