Security Disclosure

[Logan Aikas]

Hi, I have identified and reproduced a password-recovery security vulnerability in PWM v2.0.8 with potential cross-account password-reset impact. I have a working controlled PoC, negative control, source-level root cause, and proposed fix. I would prefer not to disclose the technical details publicly before maintainers have had a chance to review it. Could a PWM maintainer please provide a private email/contact channel for coordinated disclosure?

[Jason Rivard]

You can use the github security reporting page: https://github.com/pwm-project/pwm/security