[PR #15254] [MERGED] Update password reset to always return the same response structure #14268

New Issue

OVERLORD · 2026-02-07T07:27:06+03:00

OVERLORD commented

2026-02-07 07:27:06 +03:00

📋 Pull Request Information

Original PR: https://github.com/jellyfin/jellyfin/pull/15254
Author: @thornbill
Created: 10/27/2025
Status: ✅ Merged
Merged: 11/1/2025
Merged by: @crobibero

Base: release-10.11.z ← Head: password-reset

📝 Commits (3)

c2665e2 Update password reset to always return the same response structure
6c95282 Use hash of username for password reset filename
e8d7891 Simplify and standardize password reset file

📊 Changes

4 files changed (+41 additions, -32 deletions)

View changed files

📝 Jellyfin.Server.Implementations/Users/DefaultPasswordResetProvider.cs (+23 -17)
📝 Jellyfin.Server.Implementations/Users/UserManager.cs (+12 -12)
📝 MediaBrowser.Controller/Authentication/IPasswordResetProvider.cs (+2 -3)
📝 MediaBrowser.Model/Users/ForgotPasswordAction.cs (+4 -0)

📄 Description

Changes
Fixes user enumeration via password reset. The password reset process would return different responses based on whether a user account exists or not allowing enumeration of all existing user accounts.

Credit for discovery to @maru801 and Carlos García-Olalla Olivera

Issues
Security issue reported via email

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/jellyfin/jellyfin/pull/15254 **Author:** [@thornbill](https://github.com/thornbill) **Created:** 10/27/2025 **Status:** ✅ Merged **Merged:** 11/1/2025 **Merged by:** [@crobibero](https://github.com/crobibero) **Base:** `release-10.11.z` ← **Head:** `password-reset` --- ### 📝 Commits (3) - [`c2665e2`](https://github.com/jellyfin/jellyfin/commit/c2665e2d84d051dac27498d981e35f24587de118) Update password reset to always return the same response structure - [`6c95282`](https://github.com/jellyfin/jellyfin/commit/6c9528274bee4a46da271ccedaac3550a29e8e72) Use hash of username for password reset filename - [`e8d7891`](https://github.com/jellyfin/jellyfin/commit/e8d789125fdb9d75084290b209f53a8da1efae29) Simplify and standardize password reset file ### 📊 Changes **4 files changed** (+41 additions, -32 deletions) <details> <summary>View changed files</summary> 📝 `Jellyfin.Server.Implementations/Users/DefaultPasswordResetProvider.cs` (+23 -17) 📝 `Jellyfin.Server.Implementations/Users/UserManager.cs` (+12 -12) 📝 `MediaBrowser.Controller/Authentication/IPasswordResetProvider.cs` (+2 -3) 📝 `MediaBrowser.Model/Users/ForgotPasswordAction.cs` (+4 -0) </details> ### 📄 Description **Changes** Fixes user enumeration via password reset. The password reset process would return different responses based on whether a user account exists or not allowing enumeration of all existing user accounts. Credit for discovery to @maru801 and Carlos García-Olalla Olivera **Issues** Security issue reported via email --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-07 07:27:06 +03:00

OVERLORD closed this issue

2026-02-07 07:27:09 +03:00

Sign in to join this conversation.

Branches Tags

master

renovate/major-skiasharp-monorepo

renovate/sharpcompress-0.x

renovate/svg.skia-5.x

renovate/ghcr.io-devcontainers-features-docker-in-docker-4.x

release-10.11.z

standards-fix

release-10.9.z

openapi-cache

release-10.10.z

explicit-load

explicit-load-v2

feature/entity-framework

only-count-folder-item

fix/ci-workflow-refactor

release-10.8.z

release-10.7.z

EraYaN-add-management-interface

release-10.6.z

release-10.5.z

release-10.4.z

release-10.3.z

release-10.2.z

release-10.1.0

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#14268