CyberRota Analysis
AI-GeneratedAn unauthenticated remote attacker can exploit a user enumeration vulnerability in bluewave-labs/Checkmate versions up to 2.1.0, allowing them to determine if specific email addresses are registered by analyzing the responses from the password recovery endpoint. This could lead to targeted attacks, such as phishing or credential stuffing, against valid user accounts. Organizations using this software should prioritize patching to mitigate the risk of account enumeration and subsequent exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.