ResetSpy

Microsoft's public Entra ID password-reset portal leaks account existence, registered MFA methods and likely-admin status to any unauthenticated visitor

Microsoft's Self-Service Password Reset (SSPR) portal, publicly reachable at passwordreset.microsoftonline.com with no prior authentication, discloses more than it is meant to about the accounts behind it (LevelBlue SpiderLabs, 2026-09-23). Submitting an email address triggers an ASP.NET UpdatePanel POST, and the server's reply carries a hidden CurrentViewName field that tells an attacker exactly what happened server-side: ViewMultigateUserControl means the account exists and SSPR advanced to method selection, while a genuine not-found bounces back to ViewUserIdentifierVerification. Every other named view, including the documented error codes for "SSPR not enabled for this user" (SSPR_0011) and "not a member of the scoped access group" (SSPR_0013); still confirms the account exists, because the server only reaches those policy checks after resolving the username in the directory: "The server only reaches those policy checks after successfully resolving the username in the directory" (LevelBlue SpiderLabs, 2026-09-23). For an account that reaches the method-selection screen, the response HTML lists every registered second factor as visible radio buttons, with unregistered methods present in the DOM but hidden, so an attacker also learns whether a target relies on an authenticator app, SMS, or a more easily phished alternate-email one-time code.

The technique's sharpest edge is administrator identification. Microsoft enforces SSPR for admin accounts regardless of the tenant-wide SSPR policy, so in a tenant that has disabled SSPR for standard users, any account that still reaches method selection is very likely a privileged role account, and its registered factors are exposed the same way: "Admin accounts bypass this check entirely and proceed to method enumeration regardless" (LevelBlue SpiderLabs, 2026-09-23). This turns a list of candidate email addresses harvested from a company website, LinkedIn, or a data breach into a confirmed target list, ranked by which accounts have the weakest second factor, before any credential attack begins. Microsoft removed the portal's visual CAPTCHA in August 2026, replacing it with backend throttling and behavioural abuse detection rather than a challenge the user must solve (LevelBlue SpiderLabs, 2026-09-23). The researcher released a public automation tool, ResetSpy, that scripts bulk lookups with rotating user agents and randomised timing to reduce fingerprinting.