Ory Kratos v0.13.0

{
  "id": "9ab5150b458bb006dce273e5f46e097fe82d201cb387a12d3e60e3e390af9eeb",
  "url": "https://github.com/ory/kratos/releases/tag/v0.13.0",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Ory Kratos v0.13.0",
    "summary": "Ory Kratos v0.13.0 changes recovery and verification emails so unknown recipients are no longer notified by default, helping prevent account enumeration. The prior behavior can be retained through the specified configuration settings.",
    "evidence": "By default, Kratos no longer sends out these Emails.",
    "products": [
      {
        "name": {
          "value": "Ory Kratos",
          "evidence": "Ory Kratos v0.13.0"
        },
        "prerequisites": [
          {
            "value": "selfservice.flows.recovery.notify_unknown_recipients",
            "evidence": "set selfservice.flows.recovery.notify_unknown_recipients to true for recovery"
          },
          {
            "value": "selfservice.flows.verification.notify_unknown_recipients",
            "evidence": "selfservice.flows.verification.notify_unknown_recipients for verification flows"
          }
        ],
        "fixed_versions": [
          {
            "value": "v0.13.0",
            "evidence": "Ory Kratos v0.13.0"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-ory-kratos",
  "document_id": 22104,
  "published_at": "2023-04-19T14:48:30+00:00"
}