CVE-2026-100677
Received Received - Intake

Account Enumeration in StoaChat Login Endpoint

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100677
EUVD
EUVD-2026-87650

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
stoatchat stoatchat 0.15.5
stoatchat stoatchat to 0.15.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in stoatchat before version 0.15.5 allows unauthenticated attackers to determine if an email address is registered by exploiting error responses from the login endpoint. The system reveals source file locations in error messages, enabling attackers to compare these locations and identify valid accounts.

Detection Guidance

To detect this vulnerability, send POST requests to /api/auth/session/login with different email addresses and compare error responses. Registered emails will show source file locations in errors while unregistered ones may not. Use tools like curl to automate this process.

Impact Analysis

Attackers could use this to harvest valid email addresses for phishing campaigns or targeted attacks. It compromises user privacy by confirming account existence and may facilitate further social engineering or brute-force attacks against registered accounts.

Compliance Impact

This vulnerability likely violates data protection principles under GDPR and HIPAA by exposing personal data (email addresses) without authorization. It undermines user privacy rights and may lead to non-compliance with security and confidentiality requirements.

Mitigation Strategies

Upgrade stoatchat to version 0.15.5 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to the login endpoint or modify error responses to avoid exposing source file locations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart