Severity: MEDIUM
Location: src/Controllers/AuthController.php:477-488, 654
Bug: Count check and increment are separate statements; races allow extra attempts.
Fix: Single atomic UPDATE ... WHERE attempts < :max + rowcount check.
Status: open. Will reply with remediation details when resolved.
Resolved.
Both handleVerifyEmail and handleResetPassword now use an atomic counter bump in SQL (src/Controllers/AuthController.php):
UPDATE verification_codes SET attempts = attempts + 1
WHERE id = :id AND attempts < :max AND consumed = 0
The controller checks rowCount() !== 1 and treats it as a rejection. Two parallel requests can no longer both read attempts = max - 1, both pass the PHP-side guard, and both proceed to password_verify. The DB enforces the budget.
Locking this thread.