The CVSS 5.3 score on this user enumeration vulnerability in Checkmate's /api/v1/auth/recovery/request endpoint fundamentally misrepresents the actual risk profile, and you should treat it accordingly. The issue isn't just that an attacker can confirm whether an email exists—this is a password reset flow, meaning the enumeration confirms an account where the owner has already self-identified as needing recovery assistance. That's a higher-fidelity targeting signal than a generic email harvest.
The critical insight you're likely missing: this enumeration creates a deterministic oracle. The attacker receives a clear HTTP 200 versus a different status code with no probabilistic elements, no rate limiting mentioned in the finding, and no account lockout described. This makes validation trivially scalable—a single attacker can hammer an entire email list against your population in minutes with near-zero marginal cost per target. Once the list is built, your WAF rules monitoring that endpoint become irrelevant because the attacker pivots to downstream attacks (spear phishing with password reset lures, targeted credential stuffing) that never return to the recovery endpoint.
But here's where the real danger compounds: the fix itself frequently creates new oracles. Response parity—returning the same status for both existing and non-existing accounts—is the correct mitigation, but incomplete implementations leave timing differences, response body variations, or subtle error message discrepancies that re-enable enumeration. The 'genetic sequence' of this vulnerability class isn't 'enumerate → fix → done'; it's 'enumerate → partial fix → new oracle emerges from the fix itself.'
Your immediate actions: audit your SIEM rules to confirm they would actually catch enumeration patterns before relying on detection. More importantly, verify that your response parity implementation hasn't regressed—check response timing, body content, and status codes for both cases. If this platform serves high-value populations (financial, healthcare, enterprise), the downstream attack probability increases materially, and you should treat this as a priority finding regardless of the CVSS score. The validated email list the attacker builds today appreciates in value as your user base grows, and the CVE will sit in your backlog at Medium priority long after the enumeration script has done its work.