    void requestResetPassword() throws Exception
    {
        when(this.authorizationManager.hasAccess(Right.PROGRAM)).thenReturn(true);
        UserReference userReference = mock(UserReference.class);
        ResetPasswordRequestResponse requestResponse = mock(ResetPasswordRequestResponse.class);
        when(this.resetPasswordManager.requestResetPassword(userReference)).thenReturn(requestResponse);
        InternetAddress userEmail = new InternetAddress("acme@xwiki.org");
        when(requestResponse.getUserEmail()).thenReturn(userEmail);

        assertEquals(userEmail, this.scriptService.requestResetPassword(userReference));
        verify(this.resetPasswordManager).sendResetPasswordEmailRequest(requestResponse);
    }
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.