Predictable Password Reset Token

Summary

Reset tokens were MD5 hashes of (email + timestamp), allowing prediction and account takeover.

Proof of Concept

import hashlib
token = hashlib.md5(f"{email}{timestamp}".encode()).hexdigest()
# Generated token matches actual reset link

Impact

Account takeover of any user by predicting their reset token.