Potential email enumeration via new Confirmation required page
Description
FusionAuth introduced a new Confirmation required themed page in version 1.49.0. There is the potential to enumerate email addresses in FusionAuth by inspecting responses to email workflows that include this page.
Observed versions
1.49.2
Affects versions
1.49.0-1.49.2
Expected behavior
Responses for non-existent email addresses or usernames should be indistinguishable from valid email addresses or usernames.
Potential email enumeration via new Confirmation required page
Description
FusionAuth introduced a new Confirmation required themed page in version 1.49.0. There is the potential to enumerate email addresses in FusionAuth by inspecting responses to email workflows that include this page.
Observed versions
1.49.2
Affects versions
1.49.0-1.49.2
Expected behavior
Responses for non-existent email addresses or usernames should be indistinguishable from valid email addresses or usernames.
Community guidelines
All issues filed in this repository must abide by the FusionAuth community guidelines.
Additional context