> After resetting password, never login the user directly. Ask them to login manually again. What vulnerability could this close? In order to finish the reset

> After resetting password, never login the user directly. Ask them to login manually again. What vulnerability could this close? In order to finish the reset procedure in the previous step, any attacker would need to know the user's email address, and the attacker would obviously know the new password that was just set. I'm probably missing something, but I don't see this extra step adding any security.