Our application has the concept of security tokens. These are cryptographically secure randomly generated strings used when generating password reset emails, as well as email confirmations for other actions. Tokens are single use and expire after a day. The tokens provide two key pieces of information. They identify a specific account, as well as prove that the person holding the token is the owner of that account.
Currently our application does not assign a specific use for each token, a token generated for resetting a password can be used to confirm another action, and vice versa.
Assuming the token is kept secure, what, if any, potential security pitfalls could this have and should our security tokens be restricted to the purpose they were originally generated for (eg. only a password reset token can reset a password etc.)