A user enumeration vulnerability in Checkmate allows remote attackers to determine whether a given email address is registered by exploiting a difference in HTTP status codes returned from the /api/v1/auth/recovery/request endpoint. The endpoint replies with HTTP 200 when the email exists and a different code when it does not, exposing legitimate account information and aiding targeted phishing or credential‑stuffing attacks. This weakness corresponds to CWE‑204 (Information Exposure through Indirect Detection).

The affected product is bluewave‑labs Checkmate, and the vulnerability exists in all releases up to and including version 2.1.0. Deployments using any of these releases are susceptible, and no vendor‑supplied workaround is publicly documented.

The CVSS score of 5.3 places the vulnerability in the medium severity range. EPSS data is not available, and it is not currently listed in the CISA KEV catalog, indicating a moderate potential for exploitation. An unauthenticated attacker with network access can exploit the flaw by submitting POST requests to the password‑recovery API and observing status codes; no privileged permissions are required. While the attack vector is limited to the recovery endpoint, the ability to enumerate accounts can enable subsequent targeted attacks.