Description:
Fixes security issue discovered by Timothy D. Morgan.  Forgotten password challenges were guessable based on users last login and email address. Tokens are now generated based on a HMAC of login time and email address using a salt and secret key specifically for these tokens. Reference: CVE-2012-5618.

Instructions:

This vulnerability can be fixed by upgrading to 2.6.1. An upgrade to our this latest version is highly recommended.

For users who cannot upgrade for whatever reasons, you can patch your install with the patches available below.

• Download and unzip (patch file).
• Upload and replace your current files in the folders that correspond to those in the patch.