security-review-owasp-forgot-password

Review a password reset flow by analyzing identity proof, reset tokens, and session invalidation for account takeover risks. This skill assesses recovery code, configuration, and tests against OWASP guidance to identify identity confusion and privilege escalation weaknesses.

Common OWASP password reset vulnerabilities include weak identity proof, predictable reset tokens, and improper session invalidation. This skill evaluates recovery and enrollment flows to find identity confusion, rate-limiting gaps, and unsafe failure handling.

Check password reset session invalidation by tracing trust propagation and authorization changes across the recovery flow. This skill reviews code and operational controls to verify reset actions properly invalidate active sessions and prevent unauthorized access.

Yes, this skill analyzes step-up authentication and fallback identity checks within account recovery flows. It evaluates enrollment and reset configurations to ensure identity assurance levels meet OWASP security standards and prevent account takeover.

This security review covers rate limiting and audit trails for failed password resets by examining operational controls. It checks safe failure handling and rate-limited failure mechanisms to prevent brute-force attacks and ensure comprehensive recovery flow logging.

Document evidence-based findings by severity-ranking confirmed weaknesses, review gaps, and passed checks. This skill generates OWASP-aligned output for password reset security reviews, ensuring account recovery vulnerabilities are clearly categorized and actionable.