EUVD-2026-55218
GHSA-cjr5-m69m-f39c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated endpoint; low confidentiality impact limited to account existence; no integrity or availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
AnalysisAI
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation beyond network access to the Checkmate web application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), accurately reflecting the limited confidentiality impact - an attacker learns only account existence, not credentials or data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends automated POST requests to /api/v1/auth/recovery/request with a wordlist of candidate email addresses. By observing HTTP 200 versus non-200 responses, the attacker silently builds a list of valid registered accounts in minutes. … |
| Remediation | Upstream fix availability is not independently confirmed - the sole reference is the GitHub repository at https://github.com/bluewave-labs/Checkmate, and no tagged patched release version was provided in the intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Checkmate versions prior to 3.4.0 allow unauthenticated attackers to retrieve unpublished status pages and internal moni
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate th
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today