Account Takeover with the Ability to Bypass Email Verification

Assalamualaikum Bug Hunter.

Hello, This is my first post about security vulnerabilities in Web applications.
At first I saw on one of the social media, a bug hunter uploaded a certificate that came from one of the marketplaces. I was curious to look for the marketplace.

I tried the login input area and didn't get good results, so I tried to reset the password area with the path: /member/forgot

Here I am interested in this, because at first I already got "account take over via Improper Authentication". But it was fixed without replying to my email.
Okay, next is enough to know, so the step I took was to enter an email with the intention of what the next process was. And it turns out that the next step is a verification code with the path: /member/verification

With the image:

I can't think much here, what I'm thinking about is how I can get past the verification code, and I thought about changing the path that starts: “/member/verification” to “/member/reset_password/?notif_true=1” [the path I got from the process at the beginning I tried], yapp I made it to the next process, which is entering a new password without entering a verification code kode.

With the image:

I tried to enter a new password. HAH.This made me laugh IT WAS SUCCESSFUL LOGGING INTO ACCOUNT !!!!

With the image: