User enumeration in authentication mechanisms
The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not.
The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not.