Please consider a scenario where a user signs up for a web application with his email and password. After registration the user is sent a confirmation email which requires a login/session to confirm the email address. To reset his password the user has to confirm a reset password mail which is sent to his stored email address.
This is not to be confused with this similar question as the other question deals with a temporary account access which is not given here: Should you be able to reset a password without verifying the email address first? In other words: My question is not regarding an email address change but the initial sign up process.
Is there any security issue if the user is able to reset his password if his email address has not been confirmed yet?
Scenario #1 Alice mistypes her email address
- By accident the confirmation email is sent to Eve.
- Eve receives the confirmation request but is not able to confirm her email address.
- However, Eve is able to reset her password.
- Finally Eve is able to confirm her email address and obtain full control of Alice's account.
Result: The login/session requirement for email confirmation is bypassed. Thus, I think this is a bad idea. However, if a password reset is not available without a verified email address than the following could happen:
Scenario #2 Alice forgets her password and has not confirmed her email address yet
- Alice signs up with her own email address and password.
- Alice loses her session and forgets her password.
- Alice is not able to login (wrong password) and not able to verify her email (login/session required). Nor is she able to reset her password (email not verified).
- Alice lost control of her account (forever).
So, as you can see scenario #1 produces a risk that is more or less bad (probably not too bad if no other information is collected on sign up). However, scenario #2 gives a good reason to accept that risk and enable the reset without a confirmed email address. Can the risk be accepted or am I missing something?