Comment by Dumble

I find the paragraph where the author described the exploit hard to read.

Basically, he triggered the "Password Reset" process and then guessed the reset token?