Account takeover

Usually you would not, at least not from the login itself. The request authenticates correctly and looks like every other one.

The signals arrive later and from elsewhere: a changed email address, an export nobody ordered, a customer asking about a payment. An audit log that records reads as well as writes turns those hints into an answer.

Because almost everyone has an inbox, and your reset flow trusts it. That quietly makes the mailbox the real credential for your product.

It is a practical choice rather than a good one. If email is your recovery route, treat a mailbox compromise as a full takeover of everything downstream.

Yes, and reset is often where it falls down. A flow that signs the user straight in after a reset, without asking for the second factor, has made the second factor optional.

OWASP treats forgotten password as a security mechanism in its own right, with its own token rules and its own enumeration risks.

Some forms of it, yes. A code typed into a convincing fake page works for the attacker within its short life. A push prompt sent over and over at two in the morning eventually gets approved by a tired person.

OWASP still calls multi-factor authentication the best defence against most password-related attacks. Keep it, and treat it as a strong lock rather than a sealed door.

They overlap. Credential stuffing is one route in: replaying username and password pairs leaked from somewhere else. Password spraying is another, trying one common password across many accounts.

Account takeover is the outcome. Stuffing, spraying, a weak reset flow or a stolen session are all ways of getting there.