CWE-640
Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Impactr finds and proves whether CWE-640 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.