CVE-2026-72588 bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery
Unauthenticated attackers can enumerate valid user accounts by observing differential HTTP responses in the password recovery endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72588?
CVE-2026-72588 is a medium-severity vulnerability in bluewave-labs Checkmate, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
Weakness: CWE-204
Which versions are affected by CVE-2026-72588?
How do I fix CVE-2026-72588?
No fix has been published for CVE-2026-72588 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-72588 being exploited?
There is no known exploitation of CVE-2026-72588 in the wild and no public exploit code.
Sources
Also known as GHSA-cjr5-m69m-f39c.