-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pixelfed/pixelfed | composer | <= 0.11.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the password reset form's behavior when handling invalid/non-existent emails. The commit diff shows removal of value="{{ old('email') }}" from the email input field, which previously caused the form to retain submitted email addresses after failed attempts. This allowed attackers to infer valid accounts by observing whether the email field was cleared (successful submission to valid account) or retained (error state for invalid account). The file email.blade.php directly controlled this behavior, making it the vulnerable component.