Update: Forgot Password - Account recovery after suspected compromise

What is missing or needs to be updated?

The Forgot Password Cheat Sheet provides guidance for securely resetting a forgotten password, but it does not address the additional risks involved when account recovery is initiated after a suspected account compromise.

In a compromised-account scenario, an attacker may already have an active session or may have changed authentication or recovery mechanisms such as the password, email address, phone number, or MFA factors. A recovery flow that treats recently changed mechanisms as equally trusted can allow the attacker to retain control of the account or interfere with the legitimate user's recovery.

The existing Authentication, Multifactor Authentication, and Session Management Cheat Sheets contain related guidance, but there does not appear to be consolidated developer guidance for handling these risks as part of the account-recovery flow.

How should this be resolved?

Add a focused section covering security considerations for account recovery following suspected compromise. The guidance could include:

• Treat recently added or changed recovery mechanisms with additional caution during recovery.

• Consider recent security-sensitive changes, such as changes to passwords, email addresses, phone numbers, MFA factors, or recovery methods, when determining recovery assurance.

• Notify established contact channels when security-sensitive account or recovery changes occur.

• Invalidate or provide a mechanism to invalidate existing sessions and relevant recovery/reset artifacts after successful recovery.

• Require appropriate reauthentication before subsequent sensitive account changes.

• Avoid allowing a newly established recovery mechanism to immediately become the sole basis for recovering an account when compromise is suspected.

The section could cross-reference the Authentication, Multifactor Authentication, and Session Management Cheat Sheets rather than duplicating their existing guidance, and use NIST SP 800-63B-4 account-recovery and authenticator-management guidance as an authoritative reference.