Users Do Not Receive Password Reset Email for Social Accounts

Overview

This article addresses an issue where users who signed up with a social provider, such as Google, do not receive an email when attempting a password reset. The password reset page reports that an email was sent, but it never arrives. This article clarifies why this occurs and provides a potential workaround.

Applies To
  • Password Reset
  • Social Logins
  • Universal Login
Cause

The password reset page intentionally reports a successful email dispatch for all requests, even for non-existent accounts, to mitigate user enumeration attacks.

Solution

A potential workaround is to customize the text on the password reset screen. This adds a note to hint that the user might need to try an enabled social connection instead.

For example, modify the descriptionEmail on the Screen: reset-password-request to the following:

"Enter the email address to receive password reset instructions. If an email does not arrive, the account may have been created using a social provider (e.g., Google) or may not exist."

For complete instructions, refer to Customize Login Text Prompts.

Recommended content

No recommended content found...