CVE-2025-22144: Php Reset Code Empty String Sentinelcve-2025-22144-php-reset-code-empty-string-sentinel
The 'reset_code' field is being written as an empty string ('') instead of NULL. This creates a shared sentinel value across all validated users; combined with a forgot-password gate that uses isset($_GET['c']) (which is true for ''), an unauthenticated attacker can request /forgot_password/?c= and match any user whose reset_code was stored as ''. Use NULL t
