Kamron Rasuljonov

**Name of the Vulnerable Software and Affected Versions** bluewave-labs/Checkmate versions prior to 2.1.1 **Description** An unauthenticated remote attacker can determine if a specific email address is registered in the system. This is possible because the 'POST /api/v1/auth/recovery/request' endpoint returns an HTTP 200 status code for registered email addresses and a different status code for unregistered ones, allowing for the enumeration of valid user accounts. **Recommendations** Update bluewave-labs/Checkmate to version 2.1.1 or later. As a temporary mitigation, restrict access to the 'POST /api/v1/auth/recovery/request' endpoint.