Account takeover via reusable password-reset token

Password-reset token reuse in Greek Universities Network Open eClass before 4.2 allows local users to take over accounts. The password-reset workflow accepts the same one-hour reset URL after a successful password change because it does not invalidate or revoke the embedded token. Exploitation requires access to a still-valid URL, such as one recovered from browser history, and permits another password change and subsequent login as the affected account.