CVE-2026-72588 in Checkmate
Summary
by MITRE • 08/10/2026
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.