[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEA_SnegTe4BSXNGRYlnq4sUKSPp1NFgn7G4eqqCf8_E":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"ec3006c7-a4a9-4ca5-aec8-7194a40388ad","Microsoft Password Reset Portal Can Leak Account Verification Details","microsoft-password-reset-portal-can-leak-account-verification-details-df3a57","LevelBlue found Microsoft’s password reset portal can reveal valid accounts, recovery methods and likely administrator accounts without user authentication.","Microsoft's Self-Service Password Reset (SSPR) portal can reveal valid user accounts and their registered recovery methods without requiring authentication. Researchers also found that certain tenant configurations could expose likely administrator accounts. Attackers could leverage this information for targeted phishing and social engineering attacks.","Microsoft's password reset portal can leak valid account details and recovery methods.","https:\u002F\u002Fhackread.com\u002Fmicrosoft-password-reset-portal-leak-account-details\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fmicrosoft-password-reset-portal-leak-account-details.jpg","2026-09-24T17:07:00+00:00","2026-09-24T20:00:18.186672+00:00",7,[17,20,23,25,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Self-Service Password Reset (SSPR)","product",{"name":24,"type":22},"ResetSpy",{"name":26,"type":27},"MFA","technology",{"name":29,"type":27},"Entra Audit Logs","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,24],{"controls":51,"vendors":133},[52,80,106],{"slug":53,"name":54,"problem":55,"products":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[57,64,72],{"vendor_slug":58,"vendor_name":18,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":81,"name":82,"problem":83,"products":84},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[85,90,98],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":86,"product_name":87,"url":88,"description":89},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":107,"name":108,"problem":109,"products":110},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[111,118,125],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":107,"product_name":115,"url":116,"description":117},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":122,"url":123,"description":124},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[134],{"slug":58,"name":18,"logo_path":59,"roles":135},[136],"affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":151},"microsoft-sspr-portal-leaks-account-details-without-authentication","Microsoft SSPR Portal Leaks Account Details Without Authentication","Microsoft's Self-Service Password Reset portal exposes valid usernames and registered recovery methods to unauthenticated requestors, violating the principle of least privilege at the authentication boundary. This information disclosure flaw allows attackers to enumerate valid accounts and identify likely administrator targets without any credentials. The leaked recovery method details (e.g., masked email or phone) provide a roadmap for highly convincing phishing and social engineering campaigns. This matters because account enumeration is often the critical first step in credential-based attacks, and exposing admin accounts significantly elevates organizational risk. Organizations relying on SSPR as a security convenience feature may unknowingly be broadening their attack surface.",[142,143,144,145,146,147,148,149,150],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-63B Section 6: Authenticator Lifecycle Management","GDPR Article 32: Security of Processing","Microsoft Security Benchmark: Identity Management (IM-1, IM-3)",{"CIS Control 5: Account Management":152,"NIST SP 800-53 AC-17: Remote Access":153,"GDPR Article 32: Security of Processing":154,"NIST SP 800-53 AC-2: Account Management":155,"CIS Control 6: Access Control Management":156,"CIS Control 16: Application Software Security":157,"NIST SP 800-53 IA-5: Authenticator Management":158,"NIST SP 800-63B Section 6: Authenticator Lifecycle Management":159,"Microsoft Security Benchmark: Identity Management (IM-1, IM-3)":160},"Account management includes limiting what can be learned about accounts without authentication, so the SSPR portal should not confirm which usernames exist.","Remote access controls apply to externally reachable services like SSPR, which should not disclose account information before identity is verified.","Leaking usernames and partial phone numbers or email addresses is a disclosure of personal data that appropriate security of processing should prevent.","Knowing which accounts are exposed to enumeration helps prioritise protection of administrator accounts that attackers can now identify from the portal.","Access control management means unauthenticated users should not receive account details, which the SSPR portal leaked by revealing recovery methods.","Application security testing would catch an SSPR portal returning different responses for valid and invalid accounts, the flaw that enabled enumeration.","Authenticator management covers recovery methods, which should not be disclosed even in masked form, as this gave attackers a roadmap for targeted phishing.","This guidance warns that recovery flows must not leak which accounts or authenticators exist, the exact failure that let attackers enumerate users via SSPR.","These identity controls call for securing self-service recovery and protecting privileged identities, limiting how useful leaked SSPR details are to an attacker."]