Microsoft Password Reset Portal Can Leak Account Verification Details

Microsoft's Self-Service Password Reset portal exposes valid usernames and registered recovery methods to unauthenticated requestors, violating the principle of least privilege at the authentication boundary. This information disclosure flaw allows attackers to enumerate valid accounts and identify likely administrator targets without any credentials. The leaked recovery method details (e.g., masked email or phone) provide a roadmap for highly convincing phishing and social engineering campaigns. This matters because account enumeration is often the critical first step in credential-based attacks, and exposing admin accounts significantly elevates organizational risk. Organizations relying on SSPR as a security convenience feature may unknowingly be broadening their attack surface.