D-Link Nuclias Connect firmware versions up to 1.3.1.4 have a vulnerability in the 'Forgot Password' endpoint that allows unauthenticated attackers to enumerate valid email addresses by observing differences in JSON responses. This information disclosure flaw can aid attackers in identifying existing user accounts. A fix is currently under development by D-Link.