A transit password-reset endpoint accepts unlimited attempts and returns distinct messages for valid versus invalid accounts. What abuse class should the tester highlight?
Select an answer to reveal the explanation.
Short Explanation
A reset door with no bouncer and a chatty receptionist helps attackers map who is real and hammer accounts. Rate limits and careful, uniform responses close that gap. Recovery flows need the same love as login.
Full Explanation
Password-reset and other unauthenticated recovery endpoints are frequent abuse targets when rate limiting, lockouts, and response homogenization are missing. Distinct valid/invalid messages enable account enumeration, and unbounded attempts enable flooding or token guessing classes. Remediation includes throttling, consistent messaging, and monitoring. CSP or AD-delegation topics are unrelated to this web auth flow.