[IDOR] Able to check if an account is attached to an email

[pompompurin]

Upon sending a password request to an unregistered email confirms if the email has an account or not.

Unregistered Email shows this https://prnt.sc/yGa8iX62cgHi
Registered Email shows this https://prnt.sc/mF3WIdmn1UNZ

Regardless if unregistered or registered it should show the same message something similar to "If an account is registered to this email a password reset has been sent"

For users of the website reading this thread I encourage you to be careful while checking your email while this bug is active as you may receive scamming/phishing emails.

 

[1]

Thank you!