When a user resets their password via email reset link method while 2 Factor Authentication is enabled, it is possible to set a new account password without entering a valid 2FA token. Existing user sessions are terminated, so that an adversary with access to a users mail account can cause Denial of Service.
Current Behavior
1.) receive password reset email
2.) enter new password + confirmation
3.) save new password
Expected Behavior
1.) receive password reset email
2.) enter new password + confirmation
3.) enter valid 2FA token
4.) save new password
When a user resets their password via email reset link method while 2 Factor Authentication is enabled, it is possible to set a new account password without entering a valid 2FA token. Existing user sessions are terminated, so that an adversary with access to a users mail account can cause Denial of Service.
Current Behavior
1.) receive password reset email
2.) enter new password + confirmation
3.) save new password
Expected Behavior
1.) receive password reset email
2.) enter new password + confirmation
3.) enter valid 2FA token
4.) save new password