I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be triggered to that Address. As an end user, I can change the hyperlink using Chrome developer tools to point to some other valid email address and trigger password reset to that user. Should I flag this issue? What are the implications this issue might have?

  • What happens if you enter an email address that doesn't have an account? Is an email still sent to that address?
    – Daisetsu
    Mar 20, 2019 at 20:52

2 Answers 2


No, this is normal behavior. Because the reset password email is sent to that user, only the owner of the email address can reset the password. So even though you can trigger the email to be sent, it is not possible to actually reset the password of another user since you don't have access to the link in the email. Most sites work this way, where you can enter a username or email address to request a password reset for.

However, if the password reset functionality makes it possible to bypass two factor authentication, it is a serious issue. If a user has SMS tokens as second factor and the application also allows password reset through SMS, having access to SMS messages gives total access to the account.


Yes, definitely flag that issue to the developers. From what you described, this would let anyone reset anyone elses password. Have you confirmed that after changing the reset link in the dev tools you are actually able to receive this password reset?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .