ACP2E-4507: The Password Options configuration isn't applied for customer password reset requests…

Categories

Customer, GraphQL

Components

magento/module-security

Origin

adobe-commerce-support

Since QPT

1.1.78

Issue

The Password Options configuration isn't applied for customer password reset requests made through GraphQL mutations.

Steps to reproduce

1. Check and confirm the customer password options in Store > Configurations > Customers > Customer Configuration > Password Options. 1. Send a password reset email using the requestPasswordResetEmail GraphQL mutation. 1. Reset the password using the resetPassword GraphQL mutation using the token from the sent email. 1. Repeat the same steps to reset the password multiple times.

Adobe's page lists 2.4.8 - 2.4.8-p4 as compatible; the versions below are resolved from the current QPT constraints and are the ones the tool will offer.

Adobe scheduled the permanent fix for 2.4.9.

Install

Install the Quality Patches Tool with composer require magento/quality-patches, apply the prerequisites listed for all files applicable to your distribution and version first, then run vendor/bin/magento-patches apply ACP2E-4507. On Cloud, add ACP2E-4507 under stage.build.QUALITY_PATCHES in .magento.env.yaml.

For cweagans/composer-patches, choose a compatible version below and download the bundle. Copy its ACP2E-4507/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Bundle prerequisites the same way and list them first. Paths are relative to each package root, using the default -p1 level. Prefer local files when configuring composer-patches; a remote URL can change.

Patch files and compatible versions

Sources

• Adobe documentation for ACP2E-4507
• JSON API: /api/v1/patches/ACP2E-4507