CVE-2026-53908 describes a user enumeration vulnerability in MyComplianceOffice (MCO) version 25.3.3.1. The issue arises because the application provides observable response discrepancies during username reminder and password reset workflows, enabling attackers to identify valid user accounts. Attempts to contact the vendor for remediation information were unsuccessful, and no patch or official fix has been published. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level.

An attacker can leverage the observable differences in application responses to enumerate valid usernames and email addresses. This information disclosure can facilitate further targeted attacks such as phishing or brute force attempts. However, the vulnerability does not require privileges or user interaction and does not directly allow system compromise or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided and vendor contact attempts were unsuccessful, users should monitor vendor channels for updates. Until a fix is available, consider minimizing exposure of authentication endpoints or implementing generic error messages to reduce information leakage.