<![CDATA[Changing your email to someone else's locks them out.]]>Changing your email to someone else's locks them out. Registration checked for duplicate addresses; the update endpoint didn't.

I found this in a real cloud portal. Password reset doesn't recover the account; it silently logs the victim into the wrong one.

https://go.edoardotosin.com/vdp-email-2026

]]>https://board.circlewithadot.net/topic/84396a1a-06b1-42fc-b236-bada613464b9/changing-your-email-to-someone-else-s-locks-them-out.RSS for NodeMon, 25 May 2026 07:42:16 GMTThu, 21 May 2026 19:18:30 GMT60