CVE-2026-72588

Name of the Vulnerable Software and Affected Versions bluewave-labs/Checkmate versions prior to 2.1.1

Description An unauthenticated remote attacker can determine if a specific email address is registered in the system. This is possible because the 'POST /api/v1/auth/recovery/request' endpoint returns an HTTP 200 status code for registered email addresses and a different status code for unregistered ones, allowing for the enumeration of valid user accounts.

Recommendations Update bluewave-labs/Checkmate to version 2.1.1 or later. As a temporary mitigation, restrict access to the 'POST /api/v1/auth/recovery/request' endpoint.