Fleet Password Management Vulnerability Allowing Token Reuse After Password Change

A vulnerability exists in Fleet's password management logic, allowing password reset tokens to remain valid for 24 hours after a user changes their password. This could enable the reuse of a stale token to reset the password again, potentially leading to temporary account takeover. The issue affects Fleet versions prior to 4.81.0.

Impact

Exploitation of this vulnerability could allow an attacker to reuse a valid password reset token to reset a user's password, even after the user has changed it, leading to temporary account takeover.

Remediation

Users should update to Fleet version 4.81.0 or later. If a password reset token may have been exposed, wait for the token to expire before reusing the account, or contact a Fleet administrator to invalidate active sessions.