Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday.



From Ars Technica:

The company was notified of the flaw on April 20th and responded with a fix within hoursbut not until after widespread attacks, with the bug apparently spreading "like wild fire" in the hacking community.

Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password: a link with the token is sent to an account linked to the Hotmail account, and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account.

  Microsoft patches major Hotmail 0-day flaw after apparently widespread exploitation