Password reset should not disclose account existance info (OD-3023)

Password reset should not disclose account existance info #3023

Mike Smith opened 5 days ago

Screenshot From 2026-08-17 11-53-44.png

As a new user that first signed up for account at onedev.io, then thinking it would work on code.onedev.io I stumbled on this. This is kind of a no-no :)

Copy

Robin Shen removed comment 5 days ago

Robin Shen changed title 5 days ago

Previous Value	Current Value
Security issue?	Password reset should not disclose account existance info

OneDev commented 5 days ago

State changed as build OD-8183 is successful

Copy
OneDev changed state to 'Closed' 5 days ago
Previous Value Current Value
Open

Closed
Login to comment

Previous Value	Current Value
Open	Closed

Type	Security Vulnerability
Priority	Normal
Assignee	Robin Shen
Labels	No labels

Issue Votes (1)

Watchers (4)

Reference

OD-3023