Security issue! Anyone can change user password

Steps to reproduce the issue:

1. Send request POST /auth/forgot-password with an email registered in the platform

2. Send request PUT /auth/reset-password with the token retrieved in the previous step and a new password

3. Login with the new credentials

Suggested solution

The Forgot Password endpoint should return an empty response (even if the user doesn’t exist) and send the token via email.