What happened?
POST /api/auth/reset (consume a reset token + set a new password) has no rate limit, unlike every other auth endpoint — login, register, forgot, resend, and verify all call enforceRateLimits. Practical risk is low: the reset token is 256-bit random, single-use, with a 30-minute expiry, so brute-forcing it is infeasible. But a limiter here is cheap defense-in-depth and keeps the auth surface consistent.
Affected page / URL
/api/auth/reset. Source: src/app/api/auth/reset/route.ts.
Where did you see this?
Both.
Suggested fix
Add an enforceRateLimits check (per-IP, and/or per-token) mirroring the other auth routes.
What happened?
POST /api/auth/reset(consume a reset token + set a new password) has no rate limit, unlike every other auth endpoint — login, register, forgot, resend, and verify all callenforceRateLimits. Practical risk is low: the reset token is 256-bit random, single-use, with a 30-minute expiry, so brute-forcing it is infeasible. But a limiter here is cheap defense-in-depth and keeps the auth surface consistent.Affected page / URL
/api/auth/reset. Source:src/app/api/auth/reset/route.ts.Where did you see this?
Both.
Suggested fix
Add an
enforceRateLimitscheck (per-IP, and/or per-token) mirroring the other auth routes.