Changing user's email could invalidate password reset tokens Description

Changing user's email could invalidate password reset tokens Description: a task in Lego-RL-SWE-Bench-Verified (Harbor dataset). Sequence: Have account with email address foo@… Password reset request for that email (unused) foo@… account changes their email address Password reset email is used The…

The task

Sequence: Have account with email address foo@… Password reset request for that email (unused) foo@… account changes their email address Password reset email is used The password reset email's token should be rejected at that point, but in fact it is allowed. The fix is to add the user's email address into…

Part of Lego-X/Lego-RL-SWE-Bench-Verified.