Severity: MEDIUM
Location: src/Controllers/AccountController.php:244-260, 403, 448
Bug: 6-digit code with no attempt counter; session-level attacker can enumerate.
Fix: Attempt counter with lockout.
Status: open. Will reply with remediation details when resolved.
Resolved.
Attempt counters added to all three session-backed code verification flows in src/Controllers/AccountController.php:
confirmPasswordChange — tracks $_SESSION['pending_password_change']['attempts']confirmEmailChange — $_SESSION['pending_email_change']['current_attempts']finalizeEmailChange — $_SESSION['pending_email_change']['new_attempts']Each flow allows 5 wrong codes; on the 6th attempt the pending state is wiped and the user is redirected to settings. An active-session attacker can no longer enumerate all 1,000,000 6-digit codes within the 15-minute window.
Locking this thread.