The vulnerability exists in the POST /api/v1/auth/recovery/request endpoint of bluewave-labs Checkmate through version 2.1.0. When a password recovery request is made, the server returns HTTP 200 for registered email addresses and a different status code for unregistered ones. This observable response discrepancy allows an unauthenticated attacker to enumerate valid user accounts by testing email addresses. No authentication or user interaction is required to exploit this issue. The vulnerability is classified as CWE-204 (Observable Response Discrepancy).

An attacker can confirm the existence of user accounts by sending requests to the password recovery endpoint and analyzing the HTTP response codes. This information disclosure can aid in targeted phishing, social engineering, or brute-force attacks. The vulnerability does not directly allow compromise of confidentiality, integrity, or availability beyond user enumeration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing uniform responses for password recovery requests regardless of email registration status to prevent user enumeration.