HackerOne #6927 — Exposing User Data Information in Response When Resetting Password on Siklu

Source: HackerOne Report #6927

Vulnerability Summary

During the password reset flow on siklu.com, the server returned excessive user information in the HTTP response. When a password reset request was processed, the response included data that should not have been exposed at that stage of the interaction.

Technical Details

The password reset endpoint returned a response containing:

• User's full name
• User's email address (confirmed)
• Additional account metadata
• Internal user identifiers

This information leakage occurred regardless of whether the email address existed in the system or not, but the response structure differed between existing and non-existing accounts, enabling account enumeration.

Impact

• Account enumeration: Attackers can determine which email addresses are registered
• User identification: Exposed names and metadata aid in targeted attacks
• Information gathering: The leaked data can be used to build user profiles for social engineering
• Privacy violation: Sensitive user information is exposed without consent

Remediation

The vulnerability was fixed by:

1. Removing all non-essential user data from the password reset response
2. Standardizing the response format for both existing and non-existing email addresses (to prevent enumeration)
3. Implementing generic responses like 'If an account exists with that email, a reset link has been sent'

Lessons for Password Reset Design

• Password reset endpoints should return identical responses regardless of whether the email exists
• Only send the reset email — do not return user data in the response
• Rate limit password reset requests to prevent enumeration at scale
• Log password reset attempts for security monitoring