Project

General

Profile

Actions
Copy link

Bug #13768

closed
RP RP

UpdatePasswordWidget bypasses MFA

Bug #13768: UpdatePasswordWidget bypasses MFA

Added by Raf Pauwels over 1 year ago. Updated 11 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Raf Pauwels
Target version:
4.12.1
Start date:
06/05/2025
Due date:
% Done:

100%

Estimated time:

Description

The default implementation of UpdatePasswordWidget strongly authenticates a user as soon as their password is successfully changed. Not only is this discouraged by OWASP, but it bypasses second factor authentication altogether if this is in place.

The default lost password implementation reduces authentication to a single factor (email), even with MFA enabled. We can close this loophole by still requiring the normal login procedure after resetting the password.

RP Updated by Raf Pauwels over 1 year ago Actions
Copy link
 #1

  • Status changed from New to InProgress

RP Updated by Raf Pauwels over 1 year ago Actions
Copy link
 #2

  • Status changed from InProgress to Review
  • Assignee deleted (Raf Pauwels)

RP Updated by Raf Pauwels over 1 year ago Actions
Copy link
 #3

  • Status changed from Review to InProgress
  • Assignee set to Raf Pauwels

This should include a redirect to login with a notification asking the user to relogin.

MV Updated by Matthias Van Ceulebroeck about 1 year ago Actions
Copy link
 #4

  • Target version changed from 4.12.0 to 4.12.1

RP Updated by Raf Pauwels about 1 year ago Actions
Copy link
 #5

  • Status changed from InProgress to Implemented @Emweb

MV Updated by Matthias Van Ceulebroeck about 1 year ago Actions
Copy link
 #6

  • Status changed from Implemented @Emweb to Implemented @Test

MV Updated by Matthias Van Ceulebroeck 12 months ago Actions
Copy link
 #7

  • % Done changed from 0 to 100

MV Updated by Matthias Van Ceulebroeck 11 months ago Actions
Copy link
 #8

  • Status changed from Implemented @Test to Closed
Actions
Copy link

Also available in: PDF Atom