I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new password of their choosing.
The current implementation we have in mind provides a one-time use token but not a timeout feature. Currently the research I have done on the matter seems to suggest that expiring these tokens is in some way more secure than not. However, people have not been citing why that is the case.
Can someone provide a use case where that token (while still being a one-time use) not expiring would be harmful security wise?
Additional Details: I am well aware that sending a password reset link is not the most secure way to handle this problem. Ideally we would not want to obfuscate this security to the email provider. However, we have made the decision to go with a password reset link. We are only trying to determine whether we want that to expire or not. For more information on the matter: