Linking existing PNID - Server doesn't check email validity

[InternalLoss]

When trying to link a PNID to a console, the server should check PNID, password, AND email - the following HTTP headers are sent:

X-Nintendo-EMAIL: email@email.com
X-Nintendo-Local-Pin-Flag: N

NB: X-Nintendo-Local-Pin-Flag: Y is set if Parental Controls IS enabled.

[InternalLoss]

Bumping this for security reasons.

[jonbarrow]

Bumping this for security reasons.

I believe we already discussed this but isn't this only a "security" issue if the attacker already has the users username/password? If an attacker already has a users login it's game over, they can already get the users email address just by logging in?

[InternalLoss]

Potentially, though it may let them bypass usual checks (like CAPTCHA/etc) to retrieve email, assuming we had a CAPTCHA on logins on the website in future.

[jonbarrow]

What is the error sent when the email does not match

[luni-moon]

Has this been resolved, or may I work on seeing if I can fix it if I find the error in source code, not matching it correctly?