Stoatchat versions before 0.15.5 have an account enumeration vulnerability in the login endpoint. This flaw allows unauthenticated attackers to differentiate between registered and unregistered email addresses by analyzing error responses that expose source file locations. The vulnerability is identified as CVE-2026-100677 and has a medium severity rating with a CVSS score of 5.3.