Password Validity Leakage for Disabled Accounts

[harshlocham]

Login Reveals Password Correctness for Non-Active Accounts

Summary

Account status validation occurs after password verification.

Current Behavior

Inactive account + correct password:

Account is not active

Inactive account + incorrect password:

Invalid password

Security Impact

An attacker who knows a disabled account email can determine whether a password is correct.

This reveals credential validity for accounts that should not be able to authenticate.

Evidence

Covered by:

packages/auth/tests/integration/services/login.service.test.ts

Expected Behavior

Inactive or banned accounts should not reveal password correctness.

Authentication failures should not disclose whether supplied credentials are valid.

Acceptance Criteria

• Account status handling does not leak password validity.
• Authentication responses are consistent for inactive accounts.