Bug Reports
Account Takeover via Password Reset: Resetting Any User's Password
Forgot your password? So did I, and I used it to reset someone else's, silently, with no OTP and no notification sent to them. This is a real account-takeover bug in a university portal's reset flow, and the one architectural fix that closes it.