CVE-2026-100677: stoatchat before 0.15.5 Account Enumeration via Error Location
stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can send POST requests to /api/auth/session/login can compare error location fields to determine whether email addresses are registered.
Are installations running version 0.15.5 affected?
The issue is described as affecting stoatchat versions before 0.15.5. Version 0.15.5 is not identified as affected by the provided information.
How can I check whether my instance is vulnerable?
Send login requests using a known registered email address and an unregistered address, then compare the error location fields in the responses. Differing fields indicate that the endpoint can be used for account enumeration.