Executive brief
Checkmate is an open-source server monitoring and uptime tracking tool. An unauthenticated attacker can enumerate valid user email addresses by sending password recovery requests and observing different HTTP response codes. This allows adversaries to build a list of registered accounts without authentication, facilitating targeted attacks like brute-force or phishing campaigns.
Technical details
The vulnerability is a user enumeration flaw in the POST /api/v1/auth/recovery/request endpoint. The endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered addresses, enabling attackers to distinguish between valid and invalid accounts. No authentication is required to exploit this issue; attackers can submit arbitrary email addresses and observe response codes. This allows systematic enumeration of the application's user base, which can be used to facilitate further attacks such as credential stuffing, phishing, or account-targeted exploitation. Patches are available in newer versions beyond 2.1.0.
Affected products
- bluewave-labs Checkmate through 2.1.0
Timeline
- 2026-08-10: disclosed