Easy Chat Server versions 2.0 through 3.1 suffer from a pre-authentication remote password disclosure vulnerability.