Users Do Not Receive Password Reset Email for Social Accounts
This article addresses an issue where users who signed up with a social provider, such as Google, do not receive an email when attempting a password reset. The password reset page reports that an email was sent, but it never arrives. This article clarifies why this occurs and provides a potential workaround.
- Password Reset
- Social Logins
- Universal Login
The password reset page intentionally reports a successful email dispatch for all requests, even for non-existent accounts, to mitigate user enumeration attacks.
A potential workaround is to customize the text on the password reset screen. This adds a note to hint that the user might need to try an enabled social connection instead.
For example, modify the descriptionEmail on the Screen: reset-password-request to the following:
"Enter the email address to receive password reset instructions. If an email does not arrive, the account may have been created using a social provider (e.g., Google) or may not exist."
For complete instructions, refer to Customize Login Text Prompts.