The vulnerability exists in OpenAEV’s password‑reset API. When a client supplies an email address that exists in the system, the API responds with HTTP 200; when the email does not exist, it returns HTTP 400. This differential response exposes whether an account exists, which is an information‑exposure flaw classified as CWE‑204. The misuse of this flaw permits attackers to enumerate valid user accounts, potentially enabling privacy violations or targeted credential attacks, though such downstream uses are not explicitly described in the advisory.

OpenAEV‑Platform’s open source product openaev is affected across all releases beginning with version 1.11.0 and continuing up to, but not including, version 2.0.13. The patch that resolves the issue is incorporated in release 2.0.13 and later builds.

The advisory cites a CVSS score of 5.3, indicating moderate severity. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Base on the description, it is inferred that an attacker can trigger the differential responses from any network location that can reach the /api/reset endpoint without authentication, making automated enumeration straightforward. The risk is amplified if the platform is exposed to the public internet or handles sensitive user data.