Stoatchat EUVD-2026-87650

No special conditions beyond a reachable login API - remote unauthenticated exploitation against default configurations of stoatchat before 0.15.5 by sending POST /api/auth/session/login requests and comparing the error 'location' fields. The only meaningful limit is impact scope: the flaw yields account-existence oracles (email enumeration) and leaked source file locations, not authentication bypass or data modification, so its value is as a precursor to other attacks rather than a standalone compromise.

This is a genuine but low-severity information-disclosure issue, not a high-priority emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) correctly captures a remote, unauthenticated, low-complexity flaw whose only impact is low confidentiality - no integrity or availability effect. CWE-209 (information exposure through an error message) matches the description: differing error 'location' fields let an attacker tell registered from unregistered emails. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so there is no evidence of active or automatable exploitation - the flaw is a reconnaissance primitive (account enumeration) rather than a direct compromise vector. The vendor CVSS of 6.9 is somewhat generous for a single low-confidentiality leak; an independent assessment lands closer to 5.3. Net: legitimate to patch, but low real-world urgency, and its severity is bounded by the low deployment footprint of the product.

An unauthenticated attacker sends POST /api/auth/session/login requests with candidate email addresses and observes the error 'location' field, which differs for registered versus unregistered accounts. By iterating over a list of emails, the attacker builds a validated set of real accounts to feed into follow-on phishing, credential-stuffing, or password-spray campaigns. No public exploit code is identified; the technique is trivial to script against the documented endpoint.