-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pagekit/pagekit | composer | = 1.0.17 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from differential responses in password reset handling. In MVC frameworks like Pagekit, controller actions typically process form submissions. The PasswordController::forgotAction would be responsible for validating email existence and triggering password reset emails. The user enumeration occurs because this function returns explicit 'email not found' errors rather than generic success messages regardless of input. This matches the CWE-203 pattern of observable discrepancies in authentication flows.
Ongoing coverage of React2Shell