>An attacker who has visibility into the client that has the salt can already see the plaintext password. There is no way for the server to distinguish a legit

>An attacker who has visibility into the client that has the salt can already see the plaintext password. There is no way for the server to distinguish a legitimate user trying to login from an attacker trying to hack someone. So if the salt is sent to a legitimate client, the salt will also be sent to attackers. I'm not sure if sending the salt to attackers is really a vulnerability though.