Description

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-10T11:17:31.880Z",
  "pubdate": "2026-08-10T11:17:31.880Z",
  "executiveSummary": "A user enumeration vulnerability exists in the bluewave-labs/Checkmate application through version 2.1.0, posing a moderate risk to user privacy and system reconnaissance. This security flaw allows unauthenticated remote attackers to systematically determine whether a specific email address is registered within the platform. The vulnerability stems from differential response behavior in the application's authentication recovery workflow, where valid and invalid email addresses yield distinct HTTP status codes. The impact of this vulnerability centers on information disclosure, enabling malicious actors to harvest valid user accounts for subsequent targeted attacks such as credential stuffing, brute-force attacks, or targeted phishing campaigns. Exploitation requires network access to the target instance and can be executed entirely by an unauthenticated remote attacker without any prior privileges or complex interaction requirements.",
  "technicalDetails": "The vulnerability resides within the application programming interface of bluewave-labs/Checkmate through version 2.1.0, specifically impacting the POST /api/v1/auth/recovery/request endpoint. The root cause of the flaw is the implementation of disparate response handling based on the existence of a queried database record. When an unauthenticated remote client issues an HTTP POST request containing an email address to the vulnerable endpoint, the underlying backend logic verifies the presence of the identifier within the user database. If the email address is registered, the server processes the request and returns an HTTP 200 status code. Conversely, if the provided email address is unregistered, the endpoint returns a different HTTP status code.\nThis behavior introduces a classic oracle vulnerability, exposing internal state information regarding account existence to external entities. An attacker can leverage this differential response mechanism by automating HTTP requests containing dictionaries or lists of target email addresses. By parsing the resulting HTTP status codes, the attacker can rapidly separate valid accounts from invalid ones with high accuracy. The attack flow requires no authentication, zero privileges, and can be executed across standard network protocols over the public internet, provided the affected endpoint is reachable. The post-exploitation impact includes the compilation of validated user lists, which significantly enhances the efficacy of follow-up credential-based attacks or social engineering vectors against the organization."
}