Drupal\user\Controller\UserController::resetPass has this message
$this->messenger()->addWarning($this->t('Another user (%other_user) is already logged into the site on this computer, but you tried to use a one-time link for user %resetting_user... that reveals the username for authenticated user. There is no access control/user role checks, so any authenticated user is able to fetch the information.
Log in and go to /user/reset/{UID}/1/1 to see the message.
-
-
-
-
-
Active
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Is this still happening? I just tried it in Drupal 10.2, without using this module, and it doesn't reveal any information.
This is correct. There is a test for it as well:
https://git.drupalcode.org/project/drupal/-/blob/11.x/core/modules/user/...
Marking as a feature request, its not blocking the current release but should be in here.