Tennessee Valley Authority: access to profile & reset password page without authentication

Summary: Hi team, when i checking https://valleyconnect.tva.gov i see we are login! and in top of page see : Hello, null. and we can access to some internal page like Reset Password. Steps To Reproduce: go to https://valleyconnect.tva.gov click on reset passwod menu Tips by default we are login in portal and we can get status code 200 from below Api : GET /customapi/v1/user/getbasicprofileinfo HTTP/2 Host: valleyconnect.tva.gov response is : ``` HTTP/2 200 OK Content-Type: application/json; charset=utf-8 "{\"username\":null,\"email\":null,\"orgId\":null,\"hasRemoteAssistanceGrant\":false}" we can access to favorites too: GET /customapi/v1/user/getuserfavorites ``` response is : ``` HTTP/2 200 OK Date: Tue, 17 Oct 2023 14:45:02 GMT "" ``` Supporting Material/References: {F2780981} {F2780983} Impact Improper Authentication leads to access to internal page like reset password and profile...