Improper Access Control in cortezaproject/corteza-server

Hi, Old unused Password reset tokens are not getting expired after using the new one.

Suppose I am an attacker and I got access to the recovery email option of victim account. I logged in to victim recovery email (suppose that is user@gmail.com). Then I used the forget password option. I will get one password reset link. I noted the reset link and then deleted the email from user@gmail.com. In the meantime victim understood that someone got access to his account. Then he reset the password of his account (corteza) by issuing new reset link and he also changed the password of his account (corteza) so that any one cant hack again his account.

Now its time for my exploitation.

I will use my reset link which is live even after your issuance of new reset link and I will hack into victim's account.

A Suggestion to fix this issue :

Use a certain living span for a reset link.

All unused reset links should expire automatically after the issuance of a new reset link.