models/Authentication.php

@@ -37,6 +37,10 @@ class Authentication
 
 	public static function checkResetKey($id_user, $reset_key)
 	{
+		// Users without a pending reset have a blank key, which must never match.
+		if (!is_string($reset_key) || $reset_key === '')
+			return false;
+
 		$key = Registry::get('db')->queryValue('
 			SELECT reset_key
 			FROM users
@@ -45,7 +49,10 @@ class Authentication
 				'id' => $id_user,
 			]);
 
-		return $key == $reset_key;
+		if (!is_string($key) || $key === '')
+			return false;
+
+		return hash_equals($key, $reset_key);
 	}
 
 	/**