signInWithOtp has a user enumeration vulnerability

[jeremyisatrecharm]

Bug report

Note: I tried to go through vulnerability reporting but I found that to be so complex that I gave up.

Describe the bug

If you set shouldCreateUser: false, and then pass in an email address of someone who is not a user, you will get an error; whereas an actual user will not. So using this leaks info about users.

Isn't it even possible to run this via say the chrome console? If so, doing something like wrapping this call in an API endpoint does not accomplish much...

[j4w8n]

This should likely be transferred to the supabase/auth repo, as it handles the logic of returning an error.

[Hallidayo]

Hi, I've moved this issue over from the supabase repo as its more auth related.

[nikhil-mat]

any update on this?