An issue exists in Mattermost Server prior to 3.0.0. A password-reset link could be reused.
mattermost mattermost server