Legal Robot · Report #257035
User enumeration from failed login error message
Validstatus
lowseverity
8upvotes
6 Sept 2017disclosed
Summary
A security researcher reported an issue around user enumeration through examination of the failed registration error message. Since this change was reported, Legal Robot has switched to a method wherein any registration attempts for accounts that already exist will be redirected to the same pending-verification screen as successful registrations, which blocks this type of user enumeration.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.