Problem (Med — account enumeration)
Distinct auth responses leak whether an email is registered:
server/modules/auth/service.js:113-117 (forgotPassword → 404 "User not found"):21-24 (register → 409 "User already exists with this email"):162-165 (resendOtp → 404)
An attacker can enumerate registered emails (the 20/15min limiter is ample for targeted checks). login correctly uses a generic "Invalid credentials", but these three leak account existence. (Distinct from #272, which is about resend cooldown.)
Suggested fix (tiny)
Return a uniform "If an account exists, an OTP/email has been sent" for forgot-password/resend, and a generic message on register.
Would love to fix under GSSoC '26.
Problem (Med — account enumeration)
Distinct auth responses leak whether an email is registered:
server/modules/auth/service.js:113-117(forgotPassword→ 404 "User not found"):21-24(register→ 409 "User already exists with this email"):162-165(resendOtp→ 404)An attacker can enumerate registered emails (the 20/15min limiter is ample for targeted checks).
logincorrectly uses a generic "Invalid credentials", but these three leak account existence. (Distinct from #272, which is about resend cooldown.)Suggested fix (tiny)
Return a uniform "If an account exists, an OTP/email has been sent" for forgot-password/resend, and a generic message on register.
Would love to fix under GSSoC '26.