Summary:
The registration page at https:
"Looks like you already have an account, please log in to continue."
For unregistered email addresses, the application proceeds with account creation, allowing attackers to distinguish valid accounts.
Steps to Reproduce:
Visit https:
Open the signup page.
Enter an email address that is already registered.
Observe the response:
"Looks like you already have an account, please log in to continue."
Repeat with a non-existent email address.
Notice that the behavior differs, confirming whether the email exists.
Impact:
This vulnerability allows attackers to enumerate valid user accounts by testing email addresses one at a time or in bulk. Knowing which email addresses are registered can be used to:
Build a list of valid user accounts for targeted attacks.
Launch credential stuffing attacks using leaked passwords from other breaches.
Perform targeted phishing or social engineering against confirmed users.
Identify employees or high-value users who use the service, increasing the success rate of account takeover attempts.
While email enumeration alone does not grant account access, it significantly reduces uncertainty for attackers and improves the effectiveness of subsequent attacks.
Remediation:
Return a generic response for both existing and non-existing email addresses, such as:
"If the email address is eligible, you can continue with the registration or account recovery process."
Avoid revealing whether an email address is already registered through response messages, status codes, or timing differences.
Severity: Low (Information Disclosure)