Description

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-26T14:16:51.717Z",
  "pubdate": "2026-09-26T14:16:51.717Z",
  "executiveSummary": "The application stoatchat, in versions prior to 0.15.5, is susceptible to an account enumeration vulnerability residing within its authentication endpoint. This security flaw allows unauthenticated, remote attackers to determine the existence of specific user accounts by analyzing differential error responses generated during the login process.\nThe vulnerability stems from improper error handling in the POST /api/auth/session/login request path, which leaks sensitive system-level information, specifically source file paths, when processing authentication requests. By observing variations in these error messages, an attacker can confirm whether a target email address is registered within the system.\nThis vulnerability poses a significant privacy and security risk, as it facilitates user reconnaissance—a critical precursor to targeted attacks such as credential stuffing, brute-force campaigns, or social engineering. Because the attack requires no authentication or special privileges, the barrier to entry for potential adversaries is minimal. Organizations utilizing affected versions are at risk of mass user identification, which could lead to unauthorized access or the mapping of the user base for further malicious activities. Addressing this issue is essential for maintaining user anonymity and preventing the automated verification of account existence.",
  "technicalDetails": "The vulnerability is located in the authentication logic handled by the POST /api/auth/session/login endpoint. The core issue is an information disclosure flaw wherein the application returns verbose error responses that inadvertently reveal internal source file locations. This occurs because the backend logic fails to abstract or redact stack traces or internal diagnostic data before returning an HTTP response to the client.\nThe attack flow proceeds as follows: An unauthenticated attacker initiates a series of POST requests to /api/auth/session/login, providing arbitrary email addresses in the request body. When the application processes these requests, the backend logic differentiates between a registered email address and an unregistered one. If the backend interacts with the underlying database or authentication provider differently based on account presence, it triggers divergent internal execution paths.\nWhen an email address is not found, the backend logic may trigger an error or exception that includes the specific source file path involved in the lookup process within the JSON or plain-text response. Conversely, for an existing email address, the application might return a different error message (e.g., an incorrect password error) or lack the sensitive source file path disclosure. By programmatically comparing the error responses—specifically looking for the presence or absence of file path strings—the attacker can definitively map which email addresses exist on the platform.\nThis vulnerability is classified as an account enumeration flaw. It effectively bypasses the expected security controls intended to obscure account existence. The attack is fully reachable over the network without requiring any prior knowledge of the system's credentials or privileged access. The impact is significant as it allows for the high-speed enumeration of valid user identities, providing the foundation for subsequent credential stuffing attacks or targeted phishing campaigns. Furthermore, the exposure of source file paths provides additional reconnaissance data to an attacker, potentially mapping the internal directory structure of the application server, which could be leveraged to identify other vulnerable components or misconfigurations. Versions prior to 0.15.5 are confirmed to be affected by this failure to sanitize error output during the authentication flow."
}