Password reset poisoning attacks intercept password reset requests and modify them so that the links contained within a legitimate password reset email point to an attacker-controlled site. This allows an attacker to steal the unique password reset token and use it to change the user’s password.