This effectively validates the actor’s inbound password reset request, which allows the actor to then change the password  To fix this vulnerability in version 1.0.472, the OctoberCMS developer changed the line of code above to use === instead of == when comparing the values of the reset code provided by the user via an HTTP POST request.