hi

@kpwn@infosec.exchange Some people say: AC - High. Circumvention and evasion must be fulfilled in order for the exploitation to work. AT - Present. Specific parameters must be conducted in order for the attack to work. Preparation of a rouge password reset URL should be deployed.

@kpwn@infosec.exchange Thank you for the feedback. Sorry, I still don't understand, can you explain in more detail why you gave the Attack Complexity (AC) value: low and Attack Requirements (AT): none?

@kpwn@infosec.exchange I liked your post about CVSS v4.0 Public Preview.

could you please provide a score review on the vulnerability of reset password link hijacking that leads to account takeover.
here is an example link:
https://hackerone.com/reports/1108874
Thank you in advance.