CVE-2026-100677 — stoatchat before 0.15.5 Account Enumeration via Error Location
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can …
Published: 2026-09-26 · CVSS: 6.9 · CVSS 4.0
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7