OWASPASVS 5.0 requirement

ASVS-V6.4.6 Administrative users can initiate the password reset process for the user, but that this does not allow them to change or choose the user's…

L3 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V6 Authentication
Section: V6.4 Authentication Factor Lifecycle and Recovery
Level: L3 (requirement applies from this verification level up)

Requirement

Verify that administrative users can initiate the password reset process for the user, but that this does not allow them to change or choose the user's password. This prevents a situation where they know the user's password.