Skip to content

Registration leaks whether an email is already registered #7

Description

@Emp1500

What happened?

app/(auth)/register/page.tsx shows error.message from supabase.auth.signUp() verbatim. Supabase's default behavior returns a distinct "User already registered" error for duplicate emails, letting anyone check whether an email has an account — a user-enumeration issue.

Code snippet (if parser-related)


Environment

No response

Where did this happen?

Live site (code2flow-one.vercel.app)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions