The issue concerns a problem in the password reset functionality that allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. This is achieved by manipulating a URL in the `redirect` parameter to the `/portal/scr sendmd5.php` API endpoint.