[Backend][Security][P2] Eliminate Admin Email Enumeration on Signup Responses

[AnshRaj112]

Backlog ID: ISSUE-EXS-069

Source: EXSOLVIA_GITHUB_ISSUES.md / EXSOLVIA_TECHNICAL_AUDIT.md

---

Title

[Backend][Security][P2] Eliminate Admin Email Enumeration on Signup Responses

Type

Security

Repository

@EXSOLVIA-frontend

Ownership

Backend + Security

Area

Account Enumeration

Priority

P2

Severity

Medium

Labels

backend security authentication P2

Epic

EPIC-02 Authentication & Authorization

Description

Signup returns 409 revealing admin email exists (Scenario 12). Less relevant if signup disabled, still fix if bootstrap path remains.

Current Behavior

Distinct 409 for existing email.

Expected Behavior

Generic response or disable endpoint entirely (preferred via ISSUE-EXS-001).

Why This Matters

Reveals valid admin emails for targeting.

Affected Files

• exsolvia-frontend/app/api/admin/signup/route.ts (lines 28–33)

Affected Functions / APIs

• POST /api/admin/signup

Evidence From Audit

Audit Attack Scenario 12; Authentication account enumeration.

Risk / Impact

Targeted password attacks.

Recommended Direction

Prefer disable signup; if kept, uniform responses + rate limit.

Acceptance Criteria

• Existing vs new email cannot be distinguished by response body/status OR endpoint disabled
• Timing differences minimized where practical

Testing Requirements

• Security test

Dependencies

• ISSUE-EXS-001

Estimated Complexity

Small

Priority Reason

Enumeration hardening if signup path remains.

Notes

Threat: Account enumeration
Attack Vector: Signup with candidate emails
Attacker Requirements: Signup endpoint reachable
Potential Impact: Discover admin emails
Current Protection: 409 distinct message
Missing Protection: Uniform responses or disabled signup
Recommended Mitigation: Disable or genericize
Verification Method: Security test response parity