CVE-2026-72588 - A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts. - 漏洞详情

漏洞编号：CVE-2026-72588

风险等级：中危

漏洞来源：CVE

CVE 编号：CVE-2026-72588

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-204

发布/更新时间：2026-08-10 / 2026-08-28

漏洞描述

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.

漏洞描述

相关链接

相关漏洞