CVE-2026-33877: Password Reset Timing Side Channel User Enumerationcve-2026-33877-password-reset-timing-side-channel-user-enumeration
The password reset / account recovery handler awaits an artificial delay only on the "user not found" / "no email" branches and returns early, while the success path (email sent) returns without an equivalent delay. This timing differential is observable by an unauthenticated attacker and enables username/email enumeration (CWE-208 / CWE-204). Pad all branch
