warn users if someone tries to re-register their email address #1965

New Issue

MrUnknownDE · 2026-04-06T02:45:29+02:00

MrUnknownDE commented

2026-04-06 02:45:29 +02:00

Originally created by @stefan0xC on 10/9/2022

When signup is enabled it's possible to check if a user already exists for an attacker by registration which (while not practical) makes it in principle possible to enumerate users that way.

I've already made a pull request #2799 which improves the situation a bit insofar that it would get rid of the more explicit "User already exists" error message but the security could be further improved by maybe rate-limiting the registration as well as simply sending the user a mail if someone tries to re-register their email address.

So my idea would be to change the currently redundant check 382e6107fe/src/api/core/accounts.rs (L103-L109) to something like

if !user.password_hash.is_empty() {
    if CONFIG.mail_enabled() {
        mail::send_registration_attempt_warning(&user.email, &ip, ...).await;
    }
    err!("Registration not allowed or user already exists")
}

*Originally created by @stefan0xC on 10/9/2022* When signup is enabled it's possible to check if a user already exists for an attacker by registration which (while not practical) makes it in principle possible to [enumerate users](https://www.hacksplaining.com/prevention/user-enumeration) that way. I've already made a pull request #2799 which improves the situation a bit insofar that it would get rid of the more explicit `"User already exists"` error message but the security could be further improved by maybe rate-limiting the registration as well as simply sending the user a mail if someone tries to re-register their email address. So my idea would be to change the currently redundant check https://github.com/dani-garcia/vaultwarden/blob/382e6107fe79c0828c7efeb1e05b81cf2a0f2572/src/api/core/accounts.rs#L103-L109 to something like ```rust if !user.password_hash.is_empty() { if CONFIG.mail_enabled() { mail::send_registration_attempt_warning(&user.email, &ip, ...).await; } err!("Registration not allowed or user already exists") } ```

MrUnknownDE closed this issue

2026-04-06 02:45:29 +02:00

Sign in to join this conversation.

No Label enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement enhancement low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority low priority

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1965