django__django-13551

Changing user's email could invalidate password reset tokens

Verdict: the fix is stated in the issue (Tier A).

The fix is to add the user's email address into ​PasswordResetTokenGenerator._make_hash_value()

The text states the fix: “The fix is to add the user's email address into ​PasswordResetTokenGenerator._make_hash_value()”

All SWE-bench Verified tasks · more django/django tasks · How the check works