Summary
registerCongregation returns a distinct "slug already taken" error when a congregation slug already exists. Since the subdomain is the slugified name, an attacker can submit candidate names and learn which congregations exist on the platform (and thus valid tenant subdomains to target). Combined with the email-only login limiter, this yields a target list for password spraying.
Affected code
app/features/authentication/server/register-congregation.server.ts (~L20-22)
Remediation
- Make the taken/available signal non-oracular for enumeration (e.g. behind the CAPTCHA/rate-limit from the
/register abuse issue), or decouple the public subdomain from the human-readable name.
- Log and alert on enumeration patterns.
Severity
Low→Medium.
Source: internal security review (commit 0360e87, 2026-07-21).
Summary
registerCongregationreturns a distinct "slug already taken" error when a congregation slug already exists. Since the subdomain is the slugified name, an attacker can submit candidate names and learn which congregations exist on the platform (and thus valid tenant subdomains to target). Combined with the email-only login limiter, this yields a target list for password spraying.Affected code
app/features/authentication/server/register-congregation.server.ts(~L20-22)Remediation
/registerabuse issue), or decouple the public subdomain from the human-readable name.Severity
Low→Medium.
Source: internal security review (commit
0360e87, 2026-07-21).