You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@syncope.apache.org by "Francesco Chicchiriccò (Jira)" <ji...@apache.org> on 2026/06/09 07:36:00 UTC

[jira] [Commented] (SYNCOPE-1974) Harden password reset errors against user enumeration

    [ https://issues.apache.org/jira/browse/SYNCOPE-1974?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18087554#comment-18087554 ] 

Francesco Chicchiriccò commented on SYNCOPE-1974:
-------------------------------------------------

I don't think this issue is required: the password reset process requires anonymous authentication in place, hence in order to enumerate, an attacker would first to obtain the anonymous credentials.


>   Harden password reset errors against user enumeration
> -------------------------------------------------------
>
>                 Key: SYNCOPE-1974
>                 URL: https://issues.apache.org/jira/browse/SYNCOPE-1974
>             Project: Syncope
>          Issue Type: Improvement
>            Reporter: Massimiliano Perrone
>            Assignee: Massimiliano Perrone
>            Priority: Major
>             Fix For: 4.0.7, 4.1.2, 5.0.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> Password reset responses should be hardened to avoid exposing whether a submitted username or email address matches an existing user account.
> Add a configurable option to return a generic password reset response when the submitted account identifier is unknown or invalid, while preserving backward compatibility for existing deployments.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)