pemami4911 / osprey Goto Github PK

If there are multiple user documents with the same username (e.g. a user is deleted from the truevault dashboard without deleting its user document, then another user with the same username is registered), logging in might try to log in with the wrong user document - /auth/login looks for a document by username

call to truevault.documents.search should be called within truevault.document.login's callback - otherwise, changes could potentially occur before the login verification finishes, allowing a client to change another user's username or password without having the correct original password

minor issue, but duplicate verification sends same error as wrong confirmation token