A forwarded password-reset email still changes the password a day later

Reported by: Dana Whitfield (Northwind Freight, workspace owner) via support · Priority: High (customer's pick) · Component: Sign-in Linked: BILL-349 (possible credential stuffing wave, support's guess)

Customer message

"Hi, on Monday morning I forgot my password and used the reset email, set a new one and got in fine. I then forwarded that same email to our office manager, Joel, because he is always locked out and I wanted to show him how it works. Tuesday I could not sign in. My new password did not work. Joel says he only opened the email again to see the steps and clicked the button, and then the page said he could type a new password, so he did, thinking it was part of showing him. I now think someone else got in. I changed my password again in my account settings on Tuesday night. Is the old email still dangerous? How is this possible if my password was brand new?"

Support note (Priya, tier 2)

Customer thinks a leaked password, and BILL-349 is open for a stuffing wave, so I assumed that first. But I looked at her account and there was no failed sign-in burst, and she says nobody else knew the new password. I also tried the same thing on my own test account with a link I had already used and could not tell whether the page was telling the truth. I did notice the old email's link seemed to keep working on my test account even after I changed the password in settings, but that might be my browser.

Links in these emails are valid for 48 hours, so I think we should shorten that and ask her to rotate again.

Ask: Make sure an emailed reset link cannot be used to take over an account once it has done its job or once the password has changed, however the password changed. Don't break normal "forgot password" for people who have not used their link yet.