What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?

  • 1
    What was the rationale for them changing the password in the first place?
    – Cort Ammon
    Feb 6, 2019 at 23:37
  • 2
    Assuming a user isn't being notified of password changes, it can probably open a brute-force vulnerability point by allowing password resets that can eventually lead to a "success" without the password actually changing, making the user unaware that someone has obtained their password without exploiting login attempts.
    – psosuna
    Feb 6, 2019 at 23:41
  • @CortAmmon let's say that in case of a breach the user is notified to change his own passoword. But he sets the same one. Feb 6, 2019 at 23:45
  • 2
    @LucianNitescu Explanation of psosuna's logic: I assume that behind the GUI, there's an API for resetting the password where you send up the old password and the new password. psosuna is saying that if this is not rate-limited, then the attacker could guess your password against this API rather than against the login page. Of course, your password reset API should require a valid session / login token, so this really shouldn't be a valid attack. Feb 7, 2019 at 0:51
  • 2
    @MikeOunsworth Yes, this is exactly what I was thinking. And yes, it's far-fetched. But, I've seen some security horrors that make me think this isn't outside the realm of possibility...
    – psosuna
    Feb 7, 2019 at 1:12

2 Answers 2


I don't believe there are risks involved depending on the implementation. In the comments you pointed out the case is that a breach has occurred and the user was notified to change their password. In this specific case, depending on the complexity and length of the password in combination with the hash (and salt/pepper), the password might be cracked and a malicious user could login using the new same credentials which is a severe risk.

As I pointed out, it depends on the implementation. For example, if you use a one time password (like Wordpress) and an user can change the password to the same password, a malicious user might get access to the email account at some point in the future and find the one time password. Because the user now uses the same password permanently, a malicious user can now login.

To be fair, this is low risk and depending on the account, the implications could also be low so there is no real risk unless the password was leaked like you said in your comments.


Some password policies require changing the password every three months or so. By allowing the same password, or switching back and forth, this requirement can be bypassed. Whenever the password is expired, just change it to the same password and the password is valid for another three months.

However, requiring periodic password changes is no longer advised. It doesn't increase security and in some cases decreases security, when passwords like "summer2018" are used. Therefore, I would not regard the bypass of the periodic change policy a problem.

  • I think that passwords like "summer2018" is another issue at all and I also think that the applications should strictly impose secure password rules. Thanks for the input! Feb 7, 2019 at 8:01
  • this requirement can be bypassed But what is the actual risk?
    – Kevin
    Feb 7, 2019 at 16:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .