fix: Resend Verification Email Can Be Abused to Spam Mail Server by JASIM0021 · Pull Request #35971 · RocketChat/Rocket.Chat

JASIM0021 · 2025-05-12T18:12:30Z

fix: Resend Verification Email Can Be Abused to Spam Mail Server
closes: #35965

Proposed changes (including videos or screenshots)

Attempt to send multiple emails within 1 minute
User receives error indicating rate limit is enforced:

After 1 minute, user is allowed to resend
The rate limit resets and the email is sent successfully:

Rate Limiting on `users.sendConfirmationEmail` API

To prevent abuse of the users.sendConfirmationEmail endpoint (such as email spamming and server overload), a rate limiter has been implemented .

Issue(s)

closes #35965

Steps to test or reproduce

Navigate to: https:///account/profile
Below the email input, there's a "Resend Verification Email" button.
Click the button 3–4 times — you’ll receive an Error message.

Further comments

Pull Request Description

This pull request addresses an issue where the "Resend Verification Email" feature could be exploited to spam the mail server. The changes introduce a rate limiting mechanism for confirmation email requests. Specifically, the implementation tracks the timestamp of the last sent email and enforces a minimum wait time between subsequent requests. This update is made in the apps/meteor/app/api/server/v1/users.ts file. The source branch for this fix is fix/verification-email-rate-limit, and it is targeted to be merged into the develop branch.

Summary by CodeRabbit

Bug Fixes
- Fixed a vulnerability where the resend verification email feature could be abused to spam mail servers. Email verification requests are now restricted.

…t#35965

dionisio-bot · 2025-05-12T18:12:35Z

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

changeset-bot · 2025-05-12T18:12:35Z

🦋 Changeset detected

Latest commit: c0f81f4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 40 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch
@rocket.chat/uikit-playground	Patch
@rocket.chat/api-client	Patch
@rocket.chat/apps	Patch
@rocket.chat/core-services	Patch
@rocket.chat/cron	Patch
@rocket.chat/ddp-client	Patch
@rocket.chat/fuselage-ui-kit	Patch
@rocket.chat/gazzodown	Patch
@rocket.chat/http-router	Patch
@rocket.chat/livechat	Patch
@rocket.chat/model-typings	Patch
@rocket.chat/ui-avatar	Patch
@rocket.chat/ui-client	Patch
@rocket.chat/ui-contexts	Patch
@rocket.chat/ui-voip	Patch
@rocket.chat/web-ui-registration	Patch
@rocket.chat/account-service	Patch
@rocket.chat/authorization-service	Patch
@rocket.chat/ddp-streamer	Patch
@rocket.chat/omnichannel-transcript	Patch
@rocket.chat/presence-service	Patch
@rocket.chat/queue-worker	Patch
@rocket.chat/abac	Patch
@rocket.chat/federation-matrix	Patch
@rocket.chat/license	Patch
@rocket.chat/media-calls	Patch
@rocket.chat/omnichannel-services	Patch
@rocket.chat/pdf-worker	Patch
@rocket.chat/presence	Patch
rocketchat-services	Patch
@rocket.chat/models	Patch
@rocket.chat/network-broker	Patch
@rocket.chat/omni-core-ee	Patch
@rocket.chat/mock-providers	Patch
@rocket.chat/ui-video-conf	Patch
@rocket.chat/instance-status	Patch
@rocket.chat/omni-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

kody-ai · 2025-05-12T18:12:37Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

CLAassistant · 2025-05-12T18:12:37Z

All committers have signed the CLA.

apps/meteor/app/api/server/v1/users.ts

kody-ai · 2025-05-12T18:29:13Z

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

kody-ai · 2025-05-12T18:34:27Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

…021/Rocket.Chat into fix/verification-email-rate-limit

kody-ai · 2025-05-12T18:47:40Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

kody-ai · 2025-05-13T13:54:28Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

kody-ai · 2025-05-14T18:27:24Z

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Security	✅
Code Style	✅
Kody Rules	✅
Refactoring	✅
Error Handling	✅
Maintainability	✅
Potential Issues	✅
Documentation And Comments	✅
Performance And Optimization	✅
Breaking Changes	❌

Access your configuration settings here.

JASIM0021 · 2025-05-14T18:29:33Z

If someone reviews this code, it will be greatly appreciated.

apps/meteor/app/api/server/v1/users.ts

ggazzo

please check the suggestions

.changeset/eighty-windows-join.md

apps/meteor/app/api/server/v1/users.ts

coderabbitai · 2026-02-12T03:00:34Z

Walkthrough

Implements rate limiting on the email verification resend endpoint to prevent abuse. The fix constrains the endpoint to accept one request per minute, addressing the security vulnerability where unlimited rapid requests could spam mail servers.

Changes

Cohort / File(s)	Summary
Rate Limiting Implementation `apps/meteor/app/api/server/v1/users.ts`	Added rate limiting configuration to the `sendConfirmationEmail` route with `numRequestsAllowed: 1` and `intervalTimeInMS: 60000`, restricting requests to one per minute.
Changeset Documentation `.changeset/eighty-windows-join.md`	Added patch-level changeset entry for `@rocket.chat/meteor` documenting the fix for verification email abuse vulnerability.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A rabbit hops to save the day,
No more spam floods coming your way!
One email per minute, that's fair and kind,
Mail servers rejoice—peace of mind! 📧✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main security fix: adding rate limiting to prevent abuse of the Resend Verification Email feature to spam mail servers.
Linked Issues check	✅ Passed	The PR fully addresses the primary objective from `#35965`: implementing rate limiting (1 request per 60 seconds) to prevent abuse of the sendConfirmationEmail endpoint.
Out of Scope Changes check	✅ Passed	All changes are directly related to the stated objectives: a changeset entry documents the fix, and rate limiting configuration is added to the vulnerable endpoint only.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

No actionable comments were generated in the recent review. 🎉

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d312c6c and d4b492a.

📒 Files selected for processing (2)

.changeset/eighty-windows-join.md
apps/meteor/app/api/server/v1/users.ts

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

apps/meteor/app/api/server/v1/users.ts

🔇 Additional comments (2)

.changeset/eighty-windows-join.md (1)

1-5: LGTM!

Changeset entry correctly documents the patch-level fix.

apps/meteor/app/api/server/v1/users.ts (1)

1075-1078: LGTM! The rate limiter configuration is consistent with the existing pattern used by users.updateOwnBasicInfo (lines 158–161) and appropriately restricts the endpoint to 1 request per 60 seconds per authenticated user, mitigating the email spam abuse vector.

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Co-authored-by: Kevin Aleman <kaleman960@gmail.com>

apps/meteor/app/api/server/v1/users.ts

cubic-dev-ai

No issues found across 1 file

codecov · 2026-02-12T03:14:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.41%. Comparing base (d312c6c) to head (d4b492a).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #35971      +/-   ##
===========================================
- Coverage    70.42%   70.41%   -0.01%     
===========================================
  Files         3174     3174              
  Lines       111005   111005              
  Branches     20005    19965      -40     
===========================================
- Hits         78179    78168      -11     
- Misses       30780    30797      +17     
+ Partials      2046     2040       -6

Flag	Coverage Δ
e2e	`60.44% <ø> (+0.01%)`	⬆️
e2e-api	`47.81% <ø> (+0.01%)`	⬆️
unit	`71.36% <ø> (-0.04%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ggazzo · 2026-02-12T03:50:03Z

hey @JASIM0021 it took a while but its done, would you mind accepting the CLA?

JASIM0021 · 2026-02-13T13:25:23Z

hey @JASIM0021 it took a while but its done, would you mind accepting the CLA?

✅

JASIM0021 added 2 commits May 12, 2025 23:23

Resend Verification Email Can Be Abused to Spam Mail Server RocketCha…

a7755fa

…t#35965

some changes

095212d

kody-ai bot reviewed May 12, 2025

View reviewed changes

apps/meteor/app/api/server/v1/users.ts Outdated Show resolved Hide resolved

ggazzo added the Invalid PR Title label May 12, 2025

JASIM0021 changed the title ~~Resend Verification Email Can Be Abused to Spam Mail Server #35965~~ fix: Resend Verification Email Can Be Abused to Spam Mail Server #35965 May 12, 2025

review changes

1edc7f6

Merge branch 'develop' into fix/verification-email-rate-limit

9b44237

JASIM0021 added 2 commits May 13, 2025 00:15

new line change remove

aac4614

Merge branch 'fix/verification-email-rate-limit' of github.com:JASIM0…

692363f

…021/Rocket.Chat into fix/verification-email-rate-limit

JASIM0021 changed the title ~~fix: Resend Verification Email Can Be Abused to Spam Mail Server #35965~~ fix: Resend Verification Email Can Be Abused to Spam Mail Server May 13, 2025

Merge branch 'develop' into fix/verification-email-rate-limit

f2c7f3a

Merge branch 'develop' into fix/verification-email-rate-limit

556b837

JASIM0021 mentioned this pull request May 14, 2025

Resend Verification Email Can Be Abused to Spam Mail Server #35965

Closed

Merge branch 'develop' into fix/verification-email-rate-limit

e9f6ede

ggazzo added the subj: security label Feb 12, 2026

rocketchat-github-ci removed the Invalid PR Title label Feb 12, 2026

ggazzo reviewed Feb 12, 2026

View reviewed changes

apps/meteor/app/api/server/v1/users.ts Show resolved Hide resolved

ggazzo reviewed Feb 12, 2026

View reviewed changes

apps/meteor/app/api/server/v1/users.ts Outdated Show resolved Hide resolved

ggazzo requested changes Feb 12, 2026

View reviewed changes

Apply suggestions from code review

acda66a

ggazzo requested a review from a team as a code owner February 12, 2026 02:58

Fix issue with Resend Verification Email abuse

3d6ceb4

ggazzo added this to the 8.2.0 milestone Feb 12, 2026

KevLehman requested changes Feb 12, 2026

View reviewed changes

.changeset/eighty-windows-join.md Outdated Show resolved Hide resolved

apps/meteor/app/api/server/v1/users.ts Outdated Show resolved Hide resolved

ggazzo assigned ggazzo and julio-rocketchat Feb 12, 2026

Update .changeset/eighty-windows-join.md

24b57a5

Co-authored-by: Kevin Aleman <kaleman960@gmail.com>

ggazzo reviewed Feb 12, 2026

View reviewed changes

apps/meteor/app/api/server/v1/users.ts Outdated Show resolved Hide resolved

Apply suggestion from @ggazzo

9de4da3

ggazzo reviewed Feb 12, 2026

View reviewed changes

apps/meteor/app/api/server/v1/users.ts Outdated Show resolved Hide resolved

ggazzo and others added 2 commits February 12, 2026 00:03

Apply suggestion from @ggazzo

cfb5f5d

Merge branch 'develop' into fix/verification-email-rate-limit

d4b492a

cubic-dev-ai bot reviewed Feb 12, 2026

View reviewed changes

KevLehman approved these changes Feb 12, 2026

View reviewed changes

ggazzo added the stat: QA assured Means it has been tested and approved by a company insider label Feb 12, 2026

dionisio-bot bot added the stat: ready to merge PR tested and approved waiting for merge label Feb 12, 2026

Merge branch 'develop' into fix/verification-email-rate-limit

8acc886

Merge branch 'develop' into fix/verification-email-rate-limit

c0f81f4

ggazzo merged commit 1710997 into RocketChat:develop Feb 20, 2026
4 checks passed

rocketchat-github-ci mentioned this pull request Feb 20, 2026

Release 8.2.0 #38848

Open

Comments

Conversation

JASIM0021 commented May 12, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes (including videos or screenshots)

Rate Limiting on users.sendConfirmationEmail API

Issue(s)

Steps to test or reproduce

Further comments

Pull Request Description

Summary by CodeRabbit

Uh oh!

dionisio-bot bot commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

kody-ai bot commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

CLAassistant commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kody-ai bot commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Kody Review Complete

Uh oh!

kody-ai bot commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

kody-ai bot commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

kody-ai bot commented May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

kody-ai bot commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Completed! 🔥

Uh oh!

JASIM0021 commented May 14, 2025

Uh oh!

Uh oh!

Uh oh!

ggazzo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ggazzo commented Feb 12, 2026

Uh oh!

JASIM0021 commented Feb 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

JASIM0021 commented May 12, 2025 •

edited by coderabbitai bot

Loading

Rate Limiting on `users.sendConfirmationEmail` API

dionisio-bot bot commented May 12, 2025 •

edited

Loading

changeset-bot bot commented May 12, 2025 •

edited

Loading

kody-ai bot commented May 12, 2025 •

edited

Loading

CLAassistant commented May 12, 2025 •

edited

Loading

kody-ai bot commented May 12, 2025 •

edited

Loading

kody-ai bot commented May 12, 2025 •

edited

Loading

kody-ai bot commented May 12, 2025 •

edited

Loading

kody-ai bot commented May 13, 2025 •

edited

Loading

kody-ai bot commented May 14, 2025 •

edited

Loading

coderabbitai bot commented Feb 12, 2026 •

edited

Loading

codecov bot commented Feb 12, 2026 •

edited

Loading