Password reset should not disclose account existance info (OD-3023)

Password reset should not disclose account existance info #3023

Mike Smith opened 1 month ago

Screenshot From 2026-08-17 11-53-44.png

As a new user that first signed up for account at onedev.io, then thinking it would work on code.onedev.io I stumbled on this. This is kind of a no-no :)

Copy

Robin Shen removed comment 1 month ago

Robin Shen changed title 1 month ago

Previous Value	Current Value
Security issue?	Password reset should not disclose account existance info

OneDev commented 1 month ago

State changed as build OD-8183 is successful

Copy
OneDev changed state to 'Closed' 1 month ago
Previous Value Current Value
Open

Closed
Login to comment

Previous Value	Current Value
Open	Closed

Type	Security Vulnerability
Priority	Normal
Assignee	Robin Shen
Labels	No labels

Issue Votes (1)

Watchers (4)

Reference

OD-3023