security issue: form "user_pass" password resetting - email/username exists disclosure [#1998346]

function user_pass_validate(); disclosure an exist of account and email address on the site.

how to reproduce:
https://drupal.site.com/user/password with captcha enabled. type any email/account you want to check

form errors:
What code is in the image? field is required.
Sorry, admin@sitename.com is not recognized as a user name or an e-mail address.

Comment	File	Size	Author
#1	Screen Shot 2013-05-19 at 20.20.09.png	107.42 KB	soxofaan

Comments

soxofaan commented 19 May 2013 at 18:20

Status	File	Size
new	Screen Shot 2013-05-19 at 20.20.09.png	107.42 KB

What has this to do with CAPTCHA?

Even without CAPTCHA module enabled, you get "is not recognized as a user name or an e-mail address" error messages

soxofaan commented 19 May 2013 at 18:21

soxofaan commented 19 May 2013 at 18:21

Issue summary:

added more information

jacob.embree commented 6 February 2015 at 18:08

Issue summary:	View changes
Status:	Active	» Closed (won't fix)

he/him

Italian

Brescia, 🇮🇹 🇪🇺

commented 5 December 2019 at 16:27

Issue tags:

-security disclosure captcha