From aceb6db8b8e4bea9706823fe022f219ab0949453 Mon Sep 17 00:00:00 2001
From: Abdullah Atta <abdullahatta@streetwriters.co>
Date: Thu, 25 Jun 2026 13:09:19 +0500
Subject: [PATCH] core: always lowercase email address when resetting password

---
 packages/core/src/api/user-manager.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/api/user-manager.ts b/packages/core/src/api/user-manager.ts
index bbb54b5e9..c6ac5b3c6 100644
--- a/packages/core/src/api/user-manager.ts
+++ b/packages/core/src/api/user-manager.ts
@@ -696,7 +696,9 @@ class UserManager {
       `${constants.API_HOST}/users/password/${type}`,
       {
         oldPassword: oldPassword,
-        newPassword: await this.db.storage().hash(new_password, email),
+        newPassword: await this.db
+          .storage()
+          .hash(new_password, email.toLowerCase()),
         userKeys: updateUserPayload
       },
       token