July 27, 2026
Change Password Security Testing Checklist
Old Password Verification
By Varshith Reddy
1 min read
Old Password Verification
Verify old password is required.
Attempt password change without old password.
Modify request to remove old password field.
Submit incorrect old password.Verify old password is required.
Attempt password change without old password.
Modify request to remove old password field.
Submit incorrect old password.Example
POST /change-password
{
"current_password":"",
"new_password":"Password@123"
}POST /change-password
{
"current_password":"",
"new_password":"Password@123"
}Authorization Testing
Change your own password.
Modify user ID and attempt to change another user's password.
Test IDOR vulnerabilities.
Verify server-side ownership validation.Change your own password.
Modify user ID and attempt to change another user's password.
Test IDOR vulnerabilities.
Verify server-side ownership validation.Password Policy Testing
Minimum length validation.
Maximum length validation.
Weak password acceptance.
Dictionary password acceptance.
Password complexity enforcement.
Unicode character handling. Minimum length validation.
Maximum length validation.
Weak password acceptance.
Dictionary password acceptance.
Password complexity enforcement.
Unicode character handling.Password Reuse Testing
Reuse current password.
Reuse recently used passwords.
Cycle through old passwords.
Check password history enforcement.Reuse current password.
Reuse recently used passwords.
Cycle through old passwords.
Check password history enforcement.CSRF Testing
Missing CSRF token.
Invalid CSRF token.
Password change via forged request.
Cross-origin submission attempts.Missing CSRF token.
Invalid CSRF token.
Password change via forged request.
Cross-origin submission attempts.Session Management
Existing sessions invalidated after password change.
Other devices logged out.
New session generated.
Session fixation testing. Existing sessions invalidated after password change.
Other devices logged out.
New session generated.
Session fixation testing.Important
A common finding:
Password changes successfully.
Existing sessions remain active.
This can allow attackers to maintain access after a victim changes their password.A common finding:
Password changes successfully.
Existing sessions remain active.
This can allow attackers to maintain access after a victim changes their password.Race Condition Testing
Send multiple password change requests simultaneously.
Test conflicting password updates.
Verify final password consistency. Send multiple password change requests simultaneously.
Test conflicting password updates.
Verify final password consistency.Brute Force Protection
Repeated incorrect current password attempts.
Rate limiting checks.
Account lockout checks.
CAPTCHA enforcement (if applicable). Repeated incorrect current password attempts.
Rate limiting checks.
Account lockout checks.
CAPTCHA enforcement (if applicable).Input Validation
New Password Field
Leading spaces.
Trailing spaces.
Null bytes.
Special characters.
Extremely long values.Leading spaces.
Trailing spaces.
Null bytes.
Special characters.
Extremely long values.Current Password Field
Empty values.
Encoded values.
Unexpected characters. Empty values.
Encoded values.
Unexpected characters.Business Logic Testing
Change password immediately after registration.
Change password on suspended account.
Change password during pending verification.
Simultaneous password changes from multiple sessions.Change password immediately after registration.
Change password on suspended account.
Change password during pending verification.
Simultaneous password changes from multiple sessions.Information Disclosure
Stack traces.
Debug messages.
Password leakage in responses.
Password leakage in logs. Stack traces.
Debug messages.
Password leakage in responses.
Password leakage in logs.API Security Testing
Hidden parameters.
User ID manipulation.
Role manipulation.
Unauthorized endpoint access.Hidden parameters.
User ID manipulation.
Role manipulation.
Unauthorized endpoint access.MFA Integration Testing
If MFA is enabled:
Password change requires MFA.
MFA can be bypassed.
Old MFA tokens reusable.
OTP brute force protection. Password change requires MFA.
MFA can be bypassed.
Old MFA tokens reusable.
OTP brute force protection.Audit and Notification Testing
Email notification sent after password change.
Notification contains no sensitive data.
Security alerts generated.Email notification sent after password change.
Notification contains no sensitive data.
Security alerts generated.