[AkhilTheBoss]

No description provided.

[github-actions]

Severity: High — AuthController.ts:614: /auth/registration-email requires no authentication or registration secret. Anyone who knows a pending registrant’s email can replace it with their own, receive the verification code, and obtain a session for that account. Require a secret tied to the initiating registration.

Severity: High — AuthController.ts:625: Changing the email leaves previous verification codes valid. Someone with access to the original mailbox can submit its old code and receive a session for the account now associated with the corrected email. Delete existing verifications when changing the address, and ensure verification matches the user’s current email.