Password reset endpoint enumerates registered emails

description

The password reset endpoint returns different responses for registered and unregistered email addresses. Registered emails receive a 200 with body `{"sent": true}`. Unregistered emails receive a 404 with body `{"error": "no such user"}`. The endpoint also has no rate limiting, so an attacker can iterate a list of emails and determine which ones are registered. We confirmed registration status for 12 emails from a public breach corpus in under 30 seconds.

evidence

POST /api/auth/password-reset HTTP/1.1
Host: acme.dev
Content-Type: application/json

{"email":"victim@example.com"}

HTTP/1.1 200 OK
Content-Type: application/json

{"sent": true}

- vs -

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error": "no such user"}

reproduction steps

1. POST a registered email to /api/auth/password-reset → observe 200 `{sent: true}`.
2. POST an unregistered email → observe 404 `{error: 'no such user'}`.
3. Iterate a list of candidate emails to enumerate registered users.

remediation

user = db.users.find(email)
if user:
    send_reset_email(user)
return Response({'sent': True}, status=200)  # same body + timing either way