An email enumeration attack systematically tests whether email addresses or usernames belong to registered accounts by observing application responses. Different messages or behavior can reveal valid accounts for phishing, credential stuffing, brute-force logins, or password-reset attacks. section 14.1
Magic-link login
A vulnerable login page says “Email not found” for an unknown address and “Login link sent” for a registered one. A safer implementation always replies, “If an account exists, we’ve sent a login link,” without confirming account existence. section 14.1
Reduce account-discovery leakage by:
- Returning generic responses such as “Invalid credentials” or “If an account exists, we’ve sent a login link.” section 14.1
- Preventing enumeration across login, signup, and password-reset flows, not just magic-link requests. section 14.1
- Combining the mitigation with short-lived, cryptographically signed tokens and request limits for magic links. section 14.4
