# How the Adobe Module Uses Password Recovery for Account Detection

> Discover how the Adobe module uses password recovery for account detection. Analyze authentication states and recovery eligibility to identify valid, restricted, or non-existent accounts.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: deep-dive
- Published: 2026-08-29

---

**The Adobe module determines account existence by exploiting Adobe's password-recovery API flow, analyzing authentication state responses and recovery challenge eligibility to distinguish between non-existent, valid, and restricted accounts.**

The [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py) file implements a specialized reconnaissance technique that leverages Adobe's legitimate identity management infrastructure to verify email registration status without authentication credentials. By orchestrating a two-step handshake against Adobe's authentication services, the module extracts secondary contact details while avoiding the need for valid passwords.

## Step 1: Initial Authentication State Validation

The detection process begins with a `POST` request to `https://auth.services.adobe.com/signin/v1/authenticationstate`. According to the source code in [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py), the module constructs a JSON payload containing `"username": email` and includes the mandatory header `X-IMS-CLIENTID: adobedotcom2`.

If the response JSON contains an `errorCode` field, the module immediately concludes the email is **non-existent** and terminates the check. This early exit prevents unnecessary subsequent requests and reduces detection footprint.

## Step 2: Password Recovery Challenge Verification

When the initial authentication state request succeeds, the module extracts the **encrypted authentication state** from the response headers. This state token is required for subsequent recovery operations and is added to the request headers for the next phase.

The module then issues a `GET` request to `https://auth.services.adobe.com/signin/v2/challenges` with the query parameter `purpose=passwordRecovery`. This endpoint specifically targets Adobe's password-recovery workflow to test account recovery eligibility.

### Interpreting Challenge Responses

The module analyzes the JSON response from the recovery challenge endpoint to determine account status:

- **Non-existent accounts**: Detected in Step 1 via `errorCode` in the authentication state response.
- **Existing accounts with recovery disabled**: Return an `errorCode` during the challenge phase, indicating the account exists but password recovery is unavailable (potentially due to enterprise locks or security restrictions).
- **Existing accounts with recovery enabled**: Return a valid challenge object containing `secondaryEmail` (mapped to `emailrecovery`) and `securityPhoneNumber` (mapped to `phoneNumber`), confirming active registration.

## Error Handling and Rate Limit Detection

If any network exception, HTTP error, or unexpected response structure occurs during either phase, the module catches the exception and flags the result as **rate-limited** or **unknown**. This prevents false negatives during temporary service interruptions or when Adobe implements anti-automation measures, allowing the Holehe orchestrator to handle retry logic appropriately.

## Practical Implementation Examples

To execute the Adobe password-recovery check programmatically:

```python
import asyncio
from holehe import core

async def check_adobe(email: str):
    # Initialise the aiohttp client used by Holehe

    async with core.get_client() as client:
        results = []
        # Directly invoke the Adobe module

        await core.modules.software.adobe(email, client, results)
        return results

# Usage

if __name__ == "__main__":
    email_to_test = "example@example.com"
    result = asyncio.run(check_adobe(email_to_test))
    print(result)

```

For command-line execution targeting only the Adobe module:

```bash
holehe -u example@example.com -m adobe

```

The output contains a JSON object with fields `exists`, `emailrecovery`, and `phoneNumber` reflecting the detection outcome and any recovered contact metadata.

## Summary

- The Adobe module sends a `POST` request to `/signin/v1/authenticationstate` to validate if an email exists in Adobe's systems.
- Valid accounts trigger a second `GET` request to `/signin/v2/challenges?purpose=passwordRecovery` to test recovery eligibility.
- **Secondary contact information** (backup email and phone number) is extracted from successful recovery challenge responses.
- An `errorCode` in the initial response indicates a non-existent account, while an `errorCode` in the challenge response indicates an existing but restricted account.
- All exceptions are handled as potential rate limits, marking results as **unknown** rather than false negatives.

## Frequently Asked Questions

### What specific Adobe endpoints does the module target?

The module targets two primary Adobe identity management endpoints: `auth.services.adobe.com/signin/v1/authenticationstate` for initial email validation and `auth.services.adobe.com/signin/v2/challenges` for password-recovery capability verification.

### How does the module distinguish between non-existent and disabled accounts?

Non-existent accounts return an `errorCode` during the initial authentication state request, while disabled or locked accounts pass the initial check but return an `errorCode` during the recovery challenge phase.

### What account metadata can be extracted beyond simple existence?

When password recovery is enabled, the module extracts the account's registered secondary email address (`secondaryEmail`) and phone number (`securityPhoneNumber`) from the challenge response, providing additional reconnaissance value.

### How does the module handle Adobe's rate limiting?

Any network errors, HTTP exceptions, or unexpected response formats trigger the exception handler in [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py), which marks the check result as rate-limited or unknown rather than returning a definitive false negative.