EUVD-2026-64039Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated endpoint; AC:L because showURL being enabled is an admin choice, not a race or complex precondition; C:H for full credential exposure; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.
AnalysisAI
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthenticated remote visitors when the global showURL setting is enabled. The unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects from statusPageController.ts, including the secret field consumed by HttpProvider.ts as a bearer or basic-auth credential against monitored upstream services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Checkmate administrator has enabled the global showURL setting; deployments where showURL is disabled are not affected because the status-page endpoint does not expose monitor data in that configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the severity once the prerequisite configuration is in place: any unauthenticated internet user can issue a single HTTP GET and receive authorization credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Checkmate v3.9.2 immediately; this is the vendor-released patch confirmed by the GitHub release tag at https://github.com/bluewave-labs/Checkmate/releases/tag/v3.9.2 and the associated commit cc1814f507041bb0f64845bed5d5442c21e920f2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Checkmate versions 3.3.0 through 3.9.1 currently deployed and verify whether the global showURL setting is enabled; document the scope of potentially exposed credentials and services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Checkmate versions prior to 3.4.0 allow unauthenticated attackers to retrieve unpublished status pages and internal moni
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate th
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to c
Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privil
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenti
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today