HexBrain

Weblate · Report #223343

Already Registered Email Disclosure

Validstatus
lowseverity
3upvotes
17 May 2017disclosed

How it was found

Hello, In the registration at https://hosted.weblate.org/accounts/register/ , I found that trying an already used email would inform the register that you are trying used one, so with a dictionary of emails a hacker can determine the emails of all users in database and use that in phishing.

Note:I thought that I should report this because I found that all other functionalities don't reveal that the email is already used. Eg: Forget Password

Thanks.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original