The vulnerability in Vulnerability-Lookup involves the use of stateless signed tokens for account activation and password recovery that only include the user's login. Although token signature and age were validated, the system did not track token usage, allowing replay of valid tokens multiple times within their validity period. Tokens were not purpose-bound, permitting the same token to be used for both activation and recovery workflows. This flaw enables an attacker who obtains a valid token to repeatedly reset the password and take control of the account. The patch introduces purpose-bound tokens with a random nonce stored as a SHA-256 digest linked to the user account. The nonce is invalidated after a successful password change, making tokens single-use and invalidating previous tokens upon new issuance. Password changes now explicitly consume the token before committing changes.

An attacker who obtains a valid activation or password-recovery token can repeatedly reset the password and take control of the affected account during the token's validity period. This does not require knowledge of the victim's existing password or an authenticated session, significantly increasing the risk of account takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described patch introduces purpose-bound tokens and nonce invalidation to prevent token reuse. Until a patch is applied, restrict access to activation and recovery links and monitor for suspicious token usage if possible.