I am using a third party website in which I observe the following behavior for Change Password.
- The system has userA with mobileNumberA and userB with mobileNumberB
- User B wants to change password. System shows mobileNumberB (non editable field) and asks to confirm so that change password link can be sent
- User B changes the value in mobile field to mobileNumberA using developer tools and clicks ok
- System sends change password corresponding to user A's account to mobileNumberA.
User A can ignore the SMS as he didn't request to change passwords. Tthe change password link is created using both user and mobile number, and in this case only user A can change his password. User B cannot change user A's password. All these are fine. But I would expect that server should ignore if any changes are sent for non editable fields. Can I raise this as security concern?