ASVS 5.0 V6.4.6 says an administrator can start the password reset process for a user, but cannot set or choose that user's password. The goal is that no one except the user ever knows it. This is a Level 3 requirement.
Why it matters
If an admin can type a new password for someone, that admin can log in as them, and later claims of "I did not do it" cannot be disproved. It also creates a copy of the secret in chat, tickets and shell history.
How to implement it
Give admins one action: "send reset link." The user does the rest.
@require_role("admin")
def admin_trigger_reset(target_user_id: str, admin: User):
token = issue_reset_token(target_user_id, ttl_minutes=60)
send_reset_email(target_user_id, token)
audit.log("admin_reset_triggered", target=target_user_id, actor=admin.id)
return {"status": "reset email sent"}
Do not add an admin endpoint that accepts a new_password. Keep the token out of the admin's view, so the admin cannot use the link. Apply the MFA rules from V6.4.3 to the result.
How to test it
- Search the API and UI for any admin path that accepts a password for another user.
- Trigger an admin reset and confirm the admin response contains no token or link.
- Check the audit log names both the admin and the target.
Common mistakes
- A "set temporary password" button in the admin panel.
- Returning the reset URL in the admin API response.
- Resets with no audit trail.
Quick check
Can an admin generate a temporary password the user must change?
Not under V6.4.6. The admin would know the secret, even briefly. Send a reset link to the user instead.
