[Issue] Removed email disclosure

[m2-assistant]

This issue is automatically created based on existing pull request: #39570: Removed email disclosure

---

Description (*)

Display an error message indicating an incorrect email if the entered email is not required to confirm the account, regardless of whether the customer exists or not.

customer/account/confirmation

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
• All automated tests passed successfully (all builds are green)

[m2-assistant]

Hi @engcom-Bravo. Thank you for working on this issue.
In order to make sure that issue has enough information and ready for development, please read and check the following instruction: 👇

• 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).
• 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue.
• 3. Add Area: XXXXX label to the ticket, indicating the functional areas it may be related to.
• 4. Verify that the issue is reproducible on 2.4-develop branch
  Details

  - If the issue is reproducible on 2.4-develop branch, please, add the label Reproduced on 2.4.x.
  - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!
• 5. Add label Issue: Confirmed once verification is complete.
• 6. Make sure that automatic system confirms that report has been added to the backlog.

[engcom-Bravo]

Hi @Mohamed-Asar,

Thanks for your reporting and collaboration.

Could you please elaborate the steps to reproduce and if possible provide screenshots to proceed further.

Thanks.

[Mohamed-Asar]

Hi @engcom-Bravo,

Navigate to the account confirmation page: customer/account/confirmation.

Enter an email address that is associated with an existing and already confirmed account.

The page will redirect to the login page and display a message stating that the account does not require confirmation.

If you enter an email address that does not have an associated account, an error message will appear stating that the email is incorrect.

This behavior allows anyone to determine whether a customer account exists on the site, potentially exposing account status information.

[engcom-Bravo]

Hi @Mohamed-Asar,

Thanks for your update.

We are considering as Enhancement to proceed further marking this as Feature Request.

Thanks.