CVE-2026-21622: Password Reset Token Without Expiration
This function validates a password-reset / token record by comparing `$RESET.key` for plain equality without verifying the record's age or using a constant-time comparison. Reset tokens that never expire allow account takeover when an attacker obtains a previously issued (unused) reset email — e.g., from a leaked mailbox archive (CWE-613). Enforce an expirat
Elixirgreprules fetch cve-2026-21622-password-reset-token-without-expiration --engine opengrepDescription
This function validates a password-reset / token record by comparing `$RESET.key` for plain equality without verifying the record's age or using a constant-time comparison. Reset tokens that never expire allow account takeover when an attacker obtains a previously issued (unused) reset email — e.g., from a leaked mailbox archive (CWE-613). Enforce an expirat
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.