CWE-640 is a weakness class for insecure password-recovery mechanisms. It applies when an application’s reset or recovery flow is easier to misuse, expose, or bypass than it should be, allowing an attacker to obtain or abuse recovery data such as reset tokens, recovery links, or temporary codes.
This matters because password recovery often has the same power as authentication. If a recovery link is leaked through logs, public endpoints, email templates, cache, or other exposed content, an attacker may be able to take over the account without knowing the password. In web applications, these flaws are especially dangerous for administrator accounts, where a single successful recovery attack can lead to full site compromise.
In defense, secure recovery design should minimize token lifetime, bind links to the intended user, prevent sensitive data from being stored or reused as ordinary content, and avoid exposing recovery data through public interfaces. CWE-640 is a reminder that account recovery must be treated as a high-trust security path, not just a convenience feature.