Siemens Mendix Forgot Password Module Household Enumeration Vulnerability

The Mendix Forgot Password module allows your users to register your application or reset their own passwords without administrator involvement. A vulnerability exists in the Siemens Mendix Forgot Password module that can be exploited by an attacker to determine if a user is valid, allowing a brute force attack on a valid user.