Skip to content

Bug: Password validation mismatch between Login and ForgotPassword allows weak password reset #239

@pericharlabindhumadhavi-data

Description

Describe the bug
The Login page enforces strong password validation:

  • Minimum 8 characters
  • Uppercase, lowercase, number, and special character required

But the ForgotPassword page only requires minimum 6 characters with
no complexity rules. This means a user can reset their password to
something like abc123 and then be completely unable to log in
because the login form rejects it.

Where is it happening

  • src/pages/public/Login.jsx — strong validation schema
  • src/pages/public/ForgotPassword.jsx — only min(6) validation

Expected behavior
Both pages should enforce the same password policy so users
can always log in after resetting their password.

Suggested Fix
Update resetPasswordSchema in ForgotPassword.jsx to match
the same Yup validation as Login.jsx.

I would like to work on this issue under GSSoC.
Thank you.

Metadata

Metadata

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions