Password reset mail sent to Email address which is not registered to Topcoder.

[sandhiyakavi]

Description:

Able to do password reset even though the mail Id is not registered to Topcoder.

Password_reset.zip

[sandhiyakavi]

Adding to the above: If the user proceed with Resetting the password and done with resetting. The Email address is getting registered but we won't receive any confirmation mail and we won't be able to login.

Password_reset_userRegistered.zip

[sandhiyakavi]

The user is not able to change password now but still password reset mail is sent to the unregistered email id.

[jmgasper]

@sachin-maheshwari - This looks like a problem with Auth0? I don't think we can change this behaviour?

[sachin-maheshwari]

@jmgasper I think that is feature of Auth0 - as suggested in this article we can tweak the success message ? https://community.auth0.com/t/validate-if-email-address-exists-in-locks-forgot-password-screen/8335/2

[jmgasper]

@sachin-maheshwari - What should the success message be?

[sachin-maheshwari]

Oanh / @mtwomey Please suggest here.

Currently -