A password reset token is as powerful as the password for its life, usually fifteen to sixty minutes, and the recovery flow is one of the most abused paths into an account. Four patterns dominate: enumeration, where the response reveals whether an email has an account; flooding, where the attacker spams the victim with reset emails; token theft, where the token is intercepted from email or a log; and weak recovery, where a security question or a predictable backup code is the real credential. The fixes are the same response whether or not the account exists, single-use tokens, and a second factor before any credential change.
The reset token is the password, for fifteen minutes
A password reset token is a credential. It is as powerful as the password for its life, usually fifteen to sixty minutes, and anyone who holds it can set a new password and take the account. That is why the token's design matters as much as the password policy. The token should be single-use, so a second request invalidates the first. It should expire quickly, and it should be tied to the account and the request, not reusable across sessions.
OWASP's Forgot Password cheat sheet is the standing reference, and its first rule is the response: the system must give the same response whether the account exists or not. A message that says no account found with that email tells an attacker which emails have accounts. A message that says if an account exists, a reset link has been sent tells them nothing. Enumeration is the cheapest attack on the recovery flow, and the fix costs one sentence.
Related reading on this site: Home and Refund Abuse: Wardrobing, Empty Boxes, and the 15 Percent Problem cover the neighbouring problems in more depth.
The four abuse patterns
Enumeration is the reconnaissance: the attacker tests emails against the reset form and learns which ones have accounts. Flooding is the harassment: the attacker requests resets repeatedly for a victim's email, filling their inbox with legitimate reset messages until they stop reading them, or until one of them is the attacker's. Token theft is the interception: the token travels by email, and email is the weakest link in the chain, especially when the victim's mailbox is the target. Weak recovery is the bypass: a security question whose answer is public, or a backup code that is short enough to guess.
SMS pumping is the variant that costs money. The attacker triggers one-time codes to premium-rate numbers they control, or floods the victim's phone with codes, and the store pays the delivery cost for each one. CISA's credential stuffing guidance covers the adjacent risk: once an attacker has one credential, they test it everywhere, and a reset flow that hands out tokens without rate limiting is the fastest way to confirm which accounts exist.
The fixes that actually hold
Rate limit the reset form by IP, by account, and by email address. One request per minute per account is generous. Invalidate older tokens when a new one is issued, so a token the attacker collected yesterday is dead. Require a second factor before any credential change, so a reset token alone cannot take the account. Sign out old sessions after a reset, so a session the attacker opened before the reset does not survive it.
Log the reset requests and watch the patterns. A spike in reset requests for accounts that never complete them is enumeration. A spike for a single email is flooding. A reset followed within minutes by a password change from a new IP is a takeover in progress. The recovery flow is a front door. Treat it like one, and the account takeover numbers fall with it.
Frequently asked questions
How long is a password reset token valid?
Usually fifteen to sixty minutes. For that window the token is as powerful as the password, which is why it should be single-use and why a new request should invalidate any older token.
What is account enumeration?
It is an attack where the reset form reveals whether an email has an account. The fix is to give the same response whether the account exists or not: if an account exists, a reset link has been sent.
What is SMS pumping?
It is an attack where the attacker triggers one-time codes to premium-rate numbers they control, or floods a victim's phone with codes, and the store pays the delivery cost for each one. Rate limiting the reset and code forms by IP and account stops it.
Should I require two-factor authentication for password resets?
Yes. Require a second factor before any credential change, so a reset token alone cannot take the account. Sign out old sessions after a reset, so a session the attacker opened before the reset does not survive it.