[GH-ISSUE #2474] 🛡️ Bug Report: No Rate Limit on Forgot Password — Email Flooding & Abuse Risk #688

New issue

Open

opened 2026-02-26 18:48:04 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 18:48:04 +03:00

Owner

Originally created by @Cyberheroes1010 on GitHub (Feb 11, 2026).
Original GitHub issue: https://github.com/documenso/documenso/issues/2474

Issue Description

Reported by: Vikash Gupta
Severity: Medium
Category: Rate Limiting Issue / Abuse Vector / Email Flooding

Summary

The Forgot Password functionality lacks proper rate limiting, allowing an attacker to send unlimited password reset emails to any registered user.

An attacker can repeatedly trigger password reset requests, resulting in email flooding to the victim’s inbox. This can cause disruption, annoyance, and potential denial of service to the victim’s email usage.

The issue indicates missing protections against automated abuse.

Steps to Reproduce

Go to the Forgot Password page. :- https://app.documenso.com/forgot-password

Enter a valid registered email address.

Submit the reset request.

Repeat the request multiple times through intruder attack & do 40 null payload attack !

BOOM!

POC Image

Expected Behavior

Impact

📧 Email Flooding: Victim inbox can be spammed.

🚫 User Disruption: Important emails may be missed.

🤖 Automation Risk: Attackers can script large-scale abuse.

⚠️ Brand Trust Impact: Users may view emails as spam or harassment.

Business Impact

📉 Reputation Damage: Platform emails may be flagged as spam.

📨 Email Infrastructure Cost: Increased mail server load.

🛠️ Support Burden: Users report spam/reset abuse.

🔒 Security Concern: Weak abuse-prevention controls.

CVSS v3.1 (Recommended)

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Score: 5.3 — Medium
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Rationale:
No authentication required and easily repeatable, causing availability impact through email flooding.

Current Behavior

Root Cause (Likely)

Missing rate limiting on forgot password endpoint

No CAPTCHA or bot protection

No cooldown period between requests

Lack of abuse detection

Screenshots (optional)

No response

Operating System [e.g., Windows 10]

Browser [e.g., Chrome, Firefox]

Version [e.g., 2.0.1]

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @Cyberheroes1010 on GitHub (Feb 11, 2026). Original GitHub issue: https://github.com/documenso/documenso/issues/2474 ### Issue Description Reported by: Vikash Gupta Severity: Medium Category: Rate Limiting Issue / Abuse Vector / Email Flooding Summary The Forgot Password functionality lacks proper rate limiting, allowing an attacker to send unlimited password reset emails to any registered user. An attacker can repeatedly trigger password reset requests, resulting in email flooding to the victim’s inbox. This can cause disruption, annoyance, and potential denial of service to the victim’s email usage. The issue indicates missing protections against automated abuse. ### Steps to Reproduce Steps to Reproduce Go to the Forgot Password page. :- https://app.documenso.com/forgot-password Enter a valid registered email address. Submit the reset request. Repeat the request multiple times through intruder attack & do 40 null payload attack ! BOOM! POC Image <img width="1919" height="1078" alt="Image" src="https://github.com/user-attachments/assets/610138bf-0b56-407f-8d0a-a732e97ec3a6" /> <img width="1919" height="1058" alt="Image" src="https://github.com/user-attachments/assets/5f6f36f6-59af-44f5-9758-b9362b401f5e" /> <img width="1919" height="1030" alt="Image" src="https://github.com/user-attachments/assets/c95e5938-9b86-4c3e-9f9d-6180df90ffbf" /> ### Expected Behavior Impact 📧 Email Flooding: Victim inbox can be spammed. 🚫 User Disruption: Important emails may be missed. 🤖 Automation Risk: Attackers can script large-scale abuse. ⚠️ Brand Trust Impact: Users may view emails as spam or harassment. Business Impact 📉 Reputation Damage: Platform emails may be flagged as spam. 📨 Email Infrastructure Cost: Increased mail server load. 🛠️ Support Burden: Users report spam/reset abuse. 🔒 Security Concern: Weak abuse-prevention controls. CVSS v3.1 (Recommended) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Score: 5.3 — Medium Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Rationale: No authentication required and easily repeatable, causing availability impact through email flooding. ### Current Behavior Root Cause (Likely) Missing rate limiting on forgot password endpoint No CAPTCHA or bot protection No cooldown period between requests Lack of abuse detection ### Screenshots (optional) _No response_ ### Operating System [e.g., Windows 10] 1 ### Browser [e.g., Chrome, Firefox] 11 ### Version [e.g., 2.0.1] 1 ### Please check the boxes that apply to this issue report. - [x] I have searched the existing issues to make sure this is not a duplicate. - [x] I have provided steps to reproduce the issue. - [x] I have included relevant environment information. - [x] I have included any relevant screenshots. - [x] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [x] I want to work on creating a PR for this issue if approved