AIKIDO-2026-223996

TL;DR

The password-reset request endpoint (POST .../reset_password/) discloses whether an account exists by returning HTTP 400 with an email error for unknown or ineligible accounts while returning HTTP 200 for valid ones, forming a user-enumeration oracle. The token-validation and password-confirm endpoints also hard-code throttle_classes = (), so an operator's global DRF throttle configuration is silently bypassed on these security-critical flows, and they return distinct error messages that reveal token state (missing vs expired). An unauthenticated attacker can enumerate valid accounts and, when a weak token generator is configured, brute-force reset tokens without rate limiting. The fix defaults DJANGO_REST_PASSWORDRESET_NO_INFORMATION_LEAKAGE to true so the request endpoint always returns a generic 200, stops overriding global throttles on validate/confirm, and returns a single generic 404 for all token failures.