Security researchers uncover data leak in Microsoft password‑reset page

Security firm LevelBlue has identified a flaw in Microsoft’s password‑reset portal that allows unauthenticated users to confirm whether an account exists and to view associated recovery details, including likely administrator accounts.

The vulnerability resides in the portal’s verification step, where the service returns different responses depending on the presence of the entered identifier. By probing the endpoint, an attacker can infer which usernames or email addresses are registered without needing a password or other credentials.

Beyond confirming account validity, the flaw reveals the recovery methods linked to each account, such as secondary email addresses or phone numbers, and can highlight accounts that appear to have elevated privileges. This information can be leveraged for credential‑stuffing attacks, phishing campaigns, or targeted social engineering.

Password‑reset mechanisms are a common attack surface because they must balance usability with security. When error messages disclose too much, they unintentionally become enumeration tools for malicious actors. The LevelBlue findings echo earlier incidents at other large providers where similar disclosure practices were exploited.

Microsoft has not issued a public statement regarding the issue at the time of reporting. Security analysts recommend that organizations using Microsoft services monitor for unusual reset requests, enforce multi‑factor authentication, and consider additional verification layers for privileged accounts.

Industry best practices suggest that password‑reset endpoints should return generic responses that do not differentiate between valid and invalid identifiers, employ rate limiting, CAPTCHAs, and require proof of ownership before revealing any recovery information.

Experts say the discovery underscores the need for continuous security testing of authentication flows, especially for services with millions of users. Prompt remediation, such as adjusting response handling and tightening logging, can reduce the risk of large‑scale account harvesting.

The vulnerability was first reported by cybersecurity news site Hackread, which cited LevelBlue’s research. Responsible disclosure channels are expected to guide Microsoft toward a fix, while users are advised to review their recovery settings and enable additional safeguards where available.