One bug: the reset token is a predictable function of the email — rst_ + md5(email)[:12], no secret, no randomness. Compute the admin’s token for root@ratauth.io and confirm it to take the account over.
Then visit /naked/predictable-reset/confirm?email=root@ratauth.io&token=<forged>.
More hands-on practice → labs.hackxpert.com