Fix username enumeration by setting dummy cookie and constant response timing on invalid password reset attempts#1585

Open

zeropath-ai-dev[bot] wants to merge 3 commits intomasterfrom

zvuln_fix_natural_language_rule_violation_1755145637888442

Commits on Aug 14, 2025

fix: correct username enumeration vulnerability in password reset response
ZeroPath
committed
fix: Prevent username enumeration by adding dummy cookie and rate limiting
ZeroPath
committed
fix: update resetPassword logic to handle invalid session and delays
ZeroPath
committed