Password Reset Allows Any Username

[AdityaJ2305]

Description

The password reset feature allows a reset request for any username, including invalid ones, without checking if the username exists.

it is returning res.ok = true for every username

Steps to Reproduce

1. Go to the password reset page.
2. Enter a random or invalid username.
3. Submit the request and see that a success message is shown.

Expected Behavior

• The system should validate if the username exists and return an error if it does not.

Actual Behavior

• Success message is shown for any username entered, regardless of its validity.

Proposed Fix

• Validate username existence properly before processing the request.

---

[bodhish]

It's intentional; As per OWASP we should do that.

Return a consistent message for both existent and non-existent accounts.

https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html

[bodhish]

@rithviknishad 👆note