LinkJoin through 882f196 mishandles token ownership in password reset.
mitre·CWE-304·Published 2025-08-07