Weak Password Recovery Mechanism for Forgotten Password

Summary

The password reset API can be triggered without authentication and without any out-of-band confirmation step.If an attacker knows a valid username + email pair, they can call the reset endpoint directly. The application immediately generates a new password, writes it to the account, and then sends it by email. The affected versions are prior to 4.1.3.