Skip to main content

Deleted Account Can Still Log In with Error Message ("fullName" must be a string)

JM โ€œcryptotestnetโ€ Morales
support
cant-repro

image.png

๐Ÿ›ย Summary

After deleting an account onย https://community.arcblock.io/, the user can still log in using the deleted account credentials. Additionally, an error messageย ("fullName" must be a string)ย appears instead of a clear notification that the account has been deleted. This violates privacy and security expectations.

๐Ÿ”ย Steps to Reproduce

  1. Navigate to:ย https://community.arcblock.io/
  2. Delete an account viaย Account Settings.
  3. Attempt to log in using the deleted account credentials.
  4. Observe that:
  • The login isย successfulย despite the account being deleted.
  • An error message appears:ย ("fullName" must be a string).
  • The user can still interact with the platform.

๐Ÿ“‰ย Severity

Criticalย โ€“ Violates user privacy and security by allowing access to a deleted account.

๐Ÿ› ๏ธย Expected Behavior

  • Deleting an account should:
    1. Permanently disable loginย for the deleted account.
    2. Show a clear error message: text javascript "Your account has been deleted and cannot be accessed."
    3. Prevent any further activity.

๐Ÿงชย Actual Behavior

  • The deleted account can still log in and interact with the platform.
  • A cryptic error message appears instead of a user-friendly notification.

1 reply

Shuang Liu13 months ago

I can't reproduce it. Please provide more detailed steps to reproduce the issue.

Reply