PatchSiren

bluewave-labs CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM bluewave-labs CVE published 2026-08-10

CVE-2026-72588

A user enumeration vulnerability exists in bluewave-labs/Checkmate through version 2.1.0. This vulnerability allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts. [truncated]