User Information Leak via Duplicate Email Registration
A vulnerability in the latest version of the software allows attackers to leak sensitive user information by attempting to register with an existing email. The issue was identified in the user registration endpoint and has not yet been patched.
Available publicly on Dec 19 2024
Remediation Steps
- Update the user registration endpoint to prevent returning existing user information when a duplicate email is detected.
- Implement proper error handling to return a generic error message without exposing sensitive data.
- Review and update the code to ensure that sensitive information is not exposed in any other endpoints.
- Conduct a thorough security audit to identify and fix similar vulnerabilities.
- Inform users about the potential data exposure and recommend changing their passwords.
Patch Details
- Fixed Version: N/A
- Patch Commit: N/A
Want more out of Sightline?
Sightline offers even more for premium customers
Go Premium
We have - related security advisories that are available with Sightline Premium.