# Reset token appended to unvalidated URL

Server-generated reset or access token concatenated onto a client-supplied redirect URL or host before delivery

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $7,000; latest 2026-08-28. Updated 2026-11-07._

## How it works
A reset or identity flow needs to send a token to the user. Instead of building the link from a fixed server-side base, the code takes a URL (or host) from the request and appends the freshly generated token to it. The assumption that breaks: that the destination is trusted because the token is secret. The token is only secret until it is placed on a URL the attacker chose; the victim then follows the mailed or redirected link and hands the token to the attacker. No redirect is even required — the token leaves in the link itself [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md).

## Where it shows up
- Password-reset or recovery endpoints accepting a `resetPasswordUrl`, `callback`, `return`, `r`, or `done` parameter [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md)[E3](https://bugbountylibrary.com/r/h1%3A1327742.md)
- Code that concatenates a server-generated token onto a request-supplied string before templating an email [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md)
- Redirect allowlists that include third-party domains not owned by the service [E3](https://bugbountylibrary.com/r/h1%3A1327742.md)
- Prefix-only validation of a redirect target (e.g. `flickr.com/signin/yahoo/`) [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts.md)
- Token login paths that skip or disable MFA [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md)

## How to review
Find every place a token is generated and follow it to where it is emitted. The invariant: the token must only ever be placed on a URL whose scheme, host and path are fixed server-side, never on any component taken from the request. For redirect parameters, check that validation compares the full parsed host against an owned allowlist, not a string prefix — `../` after a valid prefix escapes it [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts.md). Confirm the allowlist contains only domains the service controls and still owns [E3](https://bugbountylibrary.com/r/h1%3A1327742.md). Check whether token-based login bypasses 2FA, since that raises the payoff of any leak [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md).

## How finders spotted it
- Noticed the `.done` parameter controlled where the token went and was only prefix-checked, then tried `../` traversal; when no open redirect existed on the main domain, hunted for a same-origin page loading attacker subresources to leak the token via Referer [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts.md)
- Read the public reset controller and schema, saw `resetPasswordUrl` was required and unvalidated, traced the login service to confirm the token was concatenated onto it, and checked the token authenticator to confirm 2FA was off [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md)
- After new-domain bypasses failed against a restricted allowlist, mined Wayback Machine archives for historical `r=` values and tested which old third-party domains were still trusted and unregistered [E3](https://bugbountylibrary.com/r/h1%3A1327742.md)

## Variants seen
- Token appended to an attacker-supplied reset URL and emailed to the victim [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md)
- Access token appended as a query parameter to an allowlisted but unowned redirect target [E3](https://bugbountylibrary.com/r/h1%3A1327742.md)
- Token routed through a prefix-validated redirect, then leaked via Referer from a CSP-less page [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts.md)

## Impact and severity
Leaked tokens gave full account takeover: admin control of CMS content, users and config, escalating to code execution [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md); API access to any user account [E3](https://bugbountylibrary.com/r/h1%3A1327742.md); Flickr account takeover by chaining three individually minor issues [E1](https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts.md). Severity rises with the privilege of the token holder and with 2FA bypass [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **pimcore/studio-backend-bundle (composer)** < 2025.4.6, fixed in 2025.4.6: Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account w (CVE-2026-55207). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md. Fix: https://github.com/pimcore/studio-backend-bundle/commit/ea9d329686f5e5aea2eec378d63ac2deb965bb27

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-h854-c3m3-mh5v.md
- E3: https://bugbountylibrary.com/r/h1%3A1327742.md