In a security test of a bespoke password reset platform, I came across something quite similar, so you're not alone. The JSESSIONID of the unauthenticated requ

In a security test of a bespoke password reset platform, I came across something quite similar, so you're not alone. The JSESSIONID of the unauthenticated request for a password reset (as exposed to the client as a cookie) was used as the secret in the email sent to the user. Therefore an attacker knew the emailed token before it was even sent, and could reset the account password and take it over.