The vulnerability exists in the POST /api/v1/auth/recovery/request endpoint of bluewave-labs Checkmate up to version 2.1.0. When a request is made with a registered email address, the server responds with HTTP 200, whereas a different status code is returned for unregistered emails. This observable response discrepancy allows an unauthenticated attacker to enumerate valid user accounts by testing email addresses against this endpoint.

An attacker can confirm the existence of user accounts by sending requests to the recovery endpoint and analyzing the HTTP status codes. This information disclosure can facilitate targeted phishing, social engineering, or brute force attacks. However, the vulnerability does not allow direct compromise of accounts or system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing uniform response codes for the recovery endpoint to prevent user enumeration. No official fix or temporary mitigation is currently documented.