Password Reset Workflow and UI

Question

We recently received some pentest results that flagged the password reset workflow as being vulnerable to user enumeration. When a user attempts to reset a password we get one of two responses.

If the account doesn't exist, "Password self-service is not available for the user" is returned. If the account DOES exist, you're immediately propmted with your security questions. This will allow an attacker to identify valid accounts in the domain.

Are there any setting available in 2023.2 that will chang the UI and workflow to something like, "If the account exists, you will receive a password reset link in your email" and require that link to access the security questions/reset workflow?

Answer 1

Hello,

Unfortunately, there is no such possibility in Adaxes 2023.2. However, starting from Adaxes 2025.1 you first need to enter a valid username. Only after that there is a possibility to start the verification for password self-service. On the username step, brute force protection settings apply. For details about the settings, have a look at the following tutorial: https://www.adaxes.com/help/PreventBruteForceAttacks.