Design defects/brute-force cracking + large-scale credential stuffing

Design defects/brute-force cracking + large-scale credential stuffing

The problem is found at personal center> basic Settings> modify email address:

Packet Capture analysis:

The normal business logic here should be to verify the current user's password validity. After replacing the "username" and "password" parameters, you can verify the password validity of other users, this causes brute-force cracking and database hit attacks.

If the length is more than 900, it indicates that the database hit is successful. After testing, there is an IP address limit, no account limit, and the IP address limit is about 45. That is, an IP address can hit the database 45 times, with the automatic proxy switch function, you can perform large-scale credential stuffing attacks. Attached to a successful credential stuffing User:
 
Solution:
This is a design defect. Please take it seriously. Thank you!