vulns.co
/
GKData.io MCP

Conceptual model · 1 min read

Recovery must preserve account ownership

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

The conceptual model

A limited recovery request creates an account-bound challenge. Only valid, unexpired, unused proof permits a reset. Failure preserves account state; success consumes the challenge and notifies the owner.
A limited recovery request creates an account-bound challenge. Only valid, unexpired, unused proof permits a reset. Failure preserves account state; success consumes the challenge and notifies the owner.
Full-size SVG ↗Mermaid source ↓Graphviz source ↓

Cases and references behind the model

DisclosureGitLab recovery delivery lacked verified-address binding ↗DisclosureMicrosoft account recovery lacked consistent attempt-limit enforcement ↗DisclosureInstagram recovery challenges were insufficiently bound to accounts ↗ReferenceOWASP Forgot Password ↗

Sources and provenance

  1. hackerone.com Primary source
  2. thezerohack.com Primary source
  3. thezerohack.com Primary source
  4. cheatsheetseries.owasp.org Primary source

Record reviewed 2026-10-02. Snapshot d5550c789111. Open the complete JSON contract.

GitHub snapshot 2026-10-04

d5550c789111 · JSON exports & schemas · CC BY 4.0 content / MIT software