Tuist Password Reset Flooding Vulnerability Allowing Unauthenticated Email Abuse

A vulnerability in Tuist prior to version 1.180.10 allows unauthenticated attackers to repeatedly trigger password reset emails for a known account, exploiting the forgot password flow. This issue arises from a lack of server-side throttling, enabling the abuse of email delivery resources. In self-hosted deployments, this could lead to the consumption of downstream email delivery resources by sending large volumes of unwanted emails.

Impact

Exploitation of this vulnerability could result in the unauthorized flooding of a user's inbox with password reset emails, potentially causing disruption or annoyance. In self-hosted environments, this could also lead to the misuse of email delivery resources, causing additional strain on email infrastructure.

Remediation

Users can upgrade to Tuist version 1.180.10 or later to address this vulnerability.