---
id: CVE-2026-100677
title: >-
  stoatchat before 0.15.5 contains an account enumeration vulnerability in the
  login endpoint that exposes source file locations in error responses
summary: >-
  stoatchat before 0.15.5 contains an account enumeration vulnerability in the
  login endpoint that exposes source file locations in error responses.
  Unauthenticated attackers can distinguish between registered and unregistered
  email addres…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-209
vendor: stoatchat
product: stoatchat
affected:
  - stoatchat < 0.15.5
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T14:16:51.717'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100677'
references:
  - url: >-
      https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-account-enumeration-via-error-location
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T13:33:20.910Z'
---

## Overview

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.