I don't think sending an email to a non-existent account would be a good idea, as it would allow spam to be sent to arbitrary email addresses due to repeated requests for password reset for that email address.
I have reported this bug to the security team yesterday and they made clear they don't consider it a security issue due to the username enumeration policy of Drupal. I believe that's a matter of some debate. I will post the issue here (as suggested), because of the reason the finding will not be forgotten when the view on this topic changes in the future.
I found that there is a noticeable difference (~ 1.5 second) between requesting a password reset for an existing account and a non-existent one. This difference makes it possible to find out whether an account exists or not (timing attack).
The noticeable difference in response timing is due to Drupal sending the mail if the account exists (which takes approximately a second) and just returning the response when an account does not exist (approximately 50 ms).
Example of response times for three consecutive requests:
To prevent timing attacks, the following solutions could be considered:
The following modules/versions have been tested:
Active
10.0 ✨
Last updated
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I don't think sending an email to a non-existent account would be a good idea, as it would allow spam to be sent to arbitrary email addresses due to repeated requests for password reset for that email address.