Only send password reset emails to primary address on account. (BB-14617)

Issue #11931 resolved
Gary Sackett staff created an issue

Currently, if you need to reset your password, Bitbucket sends the reset email to all email addresses on the account. This could present an issue if an organization is trying to get access to a personal account, as they can request a password reset, and get control of the account.

Comments (1)

  1. Log in to comment