AIKIDO-2026-714632

TL;DR

The nango self-hosted server exposes a password reset endpoint at POST /api/v1/account/forgot-password that returns different responses depending on whether the submitted email belongs to a registered account. Unknown emails receive an HTTP 400 user_not_found error while existing emails receive an HTTP 200 success response, letting an unauthenticated attacker enumerate valid accounts. The fix makes the endpoint always return the same HTTP 200 success response, running the reset flow only when the account exists and swallowing internal errors so responses are indistinguishable.