Description: During the user registration process, submitting the initial signup form with a randomly generated, unverified, or explicitly fake email address (e.g., hehehehheheheheheeheh@gmail.com) allows the user to instantly proceed to the next onboarding step (/register/organization). The system seemingly initializes the account session without requiring OTP or email link verification first.
Significance: Allowing users to bypass email verification and proceed deep into the onboarding flow can lead to a polluted database filled with dummy/spam accounts. It compromises the platform's ability to communicate with users and maintain a trusted user base.
Steps to Reproduce:
- Navigate to the registration page (https://app.mulearn.org/register).
- Fill out the form fields using a fake or unowned email address.
- Click to submit/register.
- Observe that the application transitions immediately to https://app.mulearn.org/register/organization and prompts to save the password.
Expected Behavior: The system should enforce an Email Verification step (via OTP or verification link) before creating the user record or allowing the user to proceed to the Organization Details step.
Actual Behavior: The user is allowed to continue through the onboarding flow seamlessly despite the email being unverified.
Device / Browser Details:
OS: Windows
Browser: Chrome
Description: During the user registration process, submitting the initial signup form with a randomly generated, unverified, or explicitly fake email address (e.g., hehehehheheheheheeheh@gmail.com) allows the user to instantly proceed to the next onboarding step (/register/organization). The system seemingly initializes the account session without requiring OTP or email link verification first.
Significance: Allowing users to bypass email verification and proceed deep into the onboarding flow can lead to a polluted database filled with dummy/spam accounts. It compromises the platform's ability to communicate with users and maintain a trusted user base.
Steps to Reproduce:
Expected Behavior: The system should enforce an Email Verification step (via OTP or verification link) before creating the user record or allowing the user to proceed to the Organization Details step.
Actual Behavior: The user is allowed to continue through the onboarding flow seamlessly despite the email being unverified.
Device / Browser Details:
OS: Windows
Browser: Chrome