Potential email enumeration via new "Confirmation required" page

[spwitt]

Potential email enumeration via new Confirmation required page

Description

FusionAuth introduced a new Confirmation required themed page in version 1.49.0. There is the potential to enumerate email addresses in FusionAuth by inspecting responses to email workflows that include this page.

Observed versions

1.49.2

Affects versions

1.49.0-1.49.2

Expected behavior

Responses for non-existent email addresses or usernames should be indistinguishable from valid email addresses or usernames.

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Additional context

• https://github.com/FusionAuth/fusionauth-issues/issues/2443