# Broken Authentication and Session Management

Phabricator reset links stayed valid after email change, allowing password reset via a removed address.

- Payout: hidden
- Severity: medium
- Program: Phabricator
- Found by: anandpingsafe
- Disclosed: 2014-08-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/17474
- Library page: https://bugbountylibrary.com/r/h1%3A17474
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium technique:legacy-endpoint vuln:account-takeover vuln:auth-bypass

**Target:** Password reset / email change flow
**Root cause:** Reset tokens are not invalidated on email address change or removal.
**Steps:**
1. Create account with `a@x.com`.
2. Logout, request password reset link, don't use it.
3. Login, change email to `b@x.com`, verify, remove `a@x.com`.
4. Logout, use the reset link sent to `a@x.com`.
5. Password is changed.
**How found:** Hypothesized that email change should expire outstanding reset tokens; tested by retaining an unused link across the change.
**Exploitation:** Anyone with access to the old email address can reset the password after the victim migrates to a new address.
**Insight:** Test account recovery token invalidation across state changes like email change, not just password change.