Email enumeration vulnerability on "Password Reset" dialogue

[Moin]

Hiding "e-mail taken" on sign-up by default

Background Under the current default settings, when signing up for an account with an e-mail that has already been registered, the sign-up form will inform of that: [Screenshot 2024-12-16 at 12.32.31 PM] We are changing the default setting to not give away this information. Instead, the sign-up form will look like this, regardless of whether the e-mail is already registered or not: [Screenshot 2024-12-16 at 12.30.04 PM] This also affects password resets in similar ways. With the setting di…