# Password reset and email change without re-authentication

State-changing reset or email-change routes that act on an email or session without verifying old password or token

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2026-01-22. Updated 2026-10-23._

## How it works
A sensitive account action (reset password, change email) is supposed to require proof that the requester is the account owner: a valid reset token, the current password, or an authenticated session. The weakness is that the handler trusts a weaker signal instead — just an email address, just a session cookie, or a check that lives somewhere else. The assumption that breaks is "the gate protects the action." In practice the gate is attached to a different endpoint, a different request, or only the UI, so the action itself runs unguarded.

## Where it shows up
- Reset endpoints that accept an email/identifier and set a new password with no token parameter or token check [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md).
- "Force reset" or admin reset routes that take an old-password field but never validate it [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smartermail-account-takeover-leading-to-rce.md).
- Email-change handlers where re-auth is enforced on an authenticate endpoint but the actual update is a separate PUT/PATCH on the user resource [E3](https://bugbountylibrary.com/r/blog%3Aahussam-me-vine-reauth-bypass.md).
- Security checks (2FA, re-auth modals) implemented only client-side [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md).
- Admin/employee portals on separate domains or CNAMEs with weaker auth than the customer app [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md).

## How to review
For every state-changing auth route, identify the exact request that mutates state and confirm the server validates a secret only the owner holds (valid single-use token, correct old password, or fresh re-auth) on that same request. The invariant: no password, email, or credential change succeeds without server-side proof of ownership bound to that action. Trace the gated action's real request, not the endpoint where the check appears to live [E3](https://bugbountylibrary.com/r/blog%3Aahussam-me-vine-reauth-bypass.md). Check that 2FA and re-auth are enforced server-side [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md), and that old-password fields are actually compared [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smartermail-account-takeover-leading-to-rce.md).

## Variants seen
- Unauthenticated reset by email only, no token [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md).
- Force-reset endpoint that ignores/does not validate the old password [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smartermail-account-takeover-leading-to-rce.md).
- Re-auth gate on one endpoint, unguarded update on another [E3](https://bugbountylibrary.com/r/blog%3Aahussam-me-vine-reauth-bypass.md).
- Client-side-only enforcement of a security gate [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md).

## Impact and severity
Led to full account takeover: employee admin accounts with vehicle control and location data [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md), privileged accounts chained to RCE [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smartermail-account-takeover-leading-to-rce.md), and account email takeover [E3](https://bugbountylibrary.com/r/blog%3Aahussam-me-vine-reauth-bypass.md). Severity is high to critical; worse when the taken-over account is privileged or the portal exposes broad data [E1](https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smartermail-account-takeover-leading-to-rce.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-subaru.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-smartermail-account-takeover-leading-to-rce.md
- E3: https://bugbountylibrary.com/r/blog%3Aahussam-me-vine-reauth-bypass.md