Craft CMS prior to 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
craftcms craft cms