MEDIUM 6.9 NVD
CVE-2026-100677
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticat
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.
References
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56
- https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-account-enumeration-via-error
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-09-26 via NVD.
vulnfeed aggregates 11675 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.