Security Advisory: Unauthorized user is able to reset password if focusIdentification is enabled

Attacker is able to change user password using password reset form, if focusIdentification is enabled and attacker manipulates URL to skip follow-up configured password reset authorization steps.

This is high-severity issue.

The affected feature is not enabled by default. The attacker can change password of existing user if focusIdentification authorization module was enabled (it is disabled by default).