User Enumeration via Distinct Login Error Messages
Summary
The login flow returns different error messages depending on whether an account exists.
Current Behavior
Non-existent email:
User not found
Existing email with incorrect password:
Invalid password
Security Impact
An attacker can determine whether an email address is registered by comparing login responses.
This allows account enumeration against the authentication system.
Evidence
Covered by integration tests in:
packages/auth/tests/integration/services/login.service.test.ts
Expected Behavior
Authentication failures should return a generic message such as:
Invalid email or password
regardless of whether the account exists.
Acceptance Criteria
- Login returns a generic authentication failure message.
- Existing integration tests updated accordingly.
- No account existence information is disclosed through response content.
User Enumeration via Distinct Login Error Messages
Summary
The login flow returns different error messages depending on whether an account exists.
Current Behavior
Non-existent email:
User not found
Existing email with incorrect password:
Invalid password
Security Impact
An attacker can determine whether an email address is registered by comparing login responses.
This allows account enumeration against the authentication system.
Evidence
Covered by integration tests in:
packages/auth/tests/integration/services/login.service.test.ts
Expected Behavior
Authentication failures should return a generic message such as:
Invalid email or password
regardless of whether the account exists.
Acceptance Criteria