Microsoft Password Reset Portal Can Leak Account Verification Details

Microsoft’s password-reset portal can be used to identify valid user accounts and, in some cases, reveal their registered password-reset verification methods without requiring authentication, according to research from LevelBlue SpiderLabs shared with Hackread.com.

The finding involves Microsoft’s public Self-Service Password Reset (SSPR) portal, a legitimate service that allows users to recover forgotten passwords without contacting their organization’s helpdesk. SpiderLabs found that the portal’s responses can provide attackers with useful reconnaissance information before they attempt to compromise an account.

Password Reset Portal Reveals Account Details

Researchers found that submitting an email address to the SSPR portal produces different responses depending on whether the account exists. A valid account can advance to the verification stage, while an invalid address produces a different response. The distinction can also be identified through a…