> Judging my the response letter it seems they think he only managed to reset a password That wouldn't really make sense, would it? As it allowed him to log in

> Judging my the response letter it seems they think he only managed to reset a password That wouldn't really make sense, would it? As it allowed him to log in. > So let’s get back to see what I’ve done here, I sent random requests using intruder with a CSRF token and random emails with a new password to this endpoint /savepassword > Now I went to the login page and I put the login email and the new password and BOOM I logged in Successfully into the application and I can enter the admin panel