An observable difference in the response to the password reset function lets an attacker determine whether a given account exists, enabling account footprinting and potentially allowing future phishing or credential stuffing attacks. The flaw arises from inadequate input validation during the authentication process, exposing information that should be concealed. This vulnerability undermines confidentiality by revealing user existence but does not provide direct access or code execution capabilities.

IKAS Technology Inc. ikas E-Commerce Infrastructure, affected from its initial release through 2026-07-13. The issue applies to any deployed instance of this product that has not applied a vendor fix.

The CVSS score is 7.5, indicating a high severity. The EPSS score is unavailable, so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known active exploits yet. The likely attack vector is a network request to the exposed password reset endpoint, inferred from the observable response difference. The impact is limited to account enumeration, but could be leveraged for further targeted attacks if combined with other social engineering or credential misuse tactics.