Password reset poisoning is an attack where a maliciously influenced link or host value alters the destination of a recovery email. The token remains valid, but it is delivered or exposed through an attacker-controlled path, which can enable account takeover if the victim follows the link.
Expanded Definition
Password reset poisoning is a recovery-flow attack in which an attacker influences the host, link, or redirect logic used in a reset email so the victim receives a valid token through an attacker-controlled destination. The token itself is not broken; the trust boundary around the delivery path is.
In NHI and IAM operations, this matters because reset workflows often bridge human login recovery, service ownership, and delegated administration. If the application accepts unsafe host headers, misuses forwarded headers, or builds reset URLs from untrusted request data, the reset link can be generated for the wrong origin. Guidance varies across vendors on how much validation should occur at the app, proxy, or email layer, but the security objective is consistent: the reset link must always resolve to the intended domain and session context. This is closely aligned with the controls mindset in the NIST Cybersecurity Framework 2.0, where identity assurance and secure recovery are part of resilient access design.
The most common misapplication is assuming a reset token is safe just because it is single-use, which occurs when the delivery URL or host is derived from attacker-influenced request metadata.
Examples and Use Cases
Implementing reset flows rigorously often introduces stricter validation and proxy configuration overhead, requiring organisations to weigh recovery convenience against the risk of account compromise.
- A web app generates password reset links from the Host header, allowing an attacker to poison the email with a malicious domain that captures the victim’s token.
- A reverse proxy forwards untrusted X-Forwarded-Host values into application logic, and the reset link is assembled from that value instead of a fixed canonical origin.
- An identity portal sends recovery emails through a shared template service, but the callback URL is taken from user-controlled input, creating an open path to token exposure.
- A help-desk-driven recovery process for an administrator account is used to trigger a reset, and the attacker positions the link to land on an impersonation site that relays the token.
- In enterprise environments, weaknesses in recovery handling can expose both human and non-human accounts, a concern reflected in NHI lifecycle guidance in the Ultimate Guide to NHIs.
For protocol-level thinking about secure request handling and origin trust, teams also use the NIST Cybersecurity Framework 2.0 as a governance anchor.
Why It Matters in NHI Security
Password reset poisoning is not only a human-account issue. The same design flaw can affect admin consoles, CI/CD portals, secrets vaults, and service ownership workflows where recovery links are used to regain access. Once an attacker can redirect a reset flow, they may take over identities that can read secrets, rotate API keys, or approve downstream actions. That turns a single poisoned email into a broader NHI compromise path.
NHI Mgmt Group reports that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, underscoring how recovery weaknesses can cascade into operational loss when identity controls fail. The related Ultimate Guide to NHIs also notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, making recovery-channel abuse especially consequential.
Practitioners should treat reset-link origin control, proxy trust, and token delivery integrity as part of the same control plane, not separate concerns. Organisations typically encounter the consequence only after an unauthorized login or secrets exposure has already occurred, at which point password reset poisoning becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Reset poisoning exposes tokens and weakens secret handling across identity recovery paths. |
| NIST CSF 2.0 | PR.AC-7 | Identity proofing and access recovery controls depend on trustworthy reset mechanisms. |
| NIST SP 800-63 | IAL/AAL related recovery guidance | Digital identity recovery must preserve assurance when credentials are reset. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust relies on trusted transaction paths, including recovery and reset flows. |
| OWASP Agentic AI Top 10 | If agents trigger recovery actions, poisoned links can redirect automated trust decisions. |
Treat reset endpoints as untrusted entry points and validate origin and routing explicitly.
