This issue requires manual confirmation.

Username Disclosure occurs when web applications inadvertently reveal usernames of registered users, administrators, or system accounts. This can happen via login forms, error messages, profile pages, API responses, or backup files. Exposed usernames give attackers a head start for brute-force attacks, password guessing, social engineering, or credential stuffing campaigns, increasing the risk of account compromise.

Common patterns leading to username disclosure:

• Login pages indicating which part of a login attempt is incorrect (e.g., "username not found").
• Publicly accessible user directories or profile listings.
• Error messages or logs exposing user account details.
• Backup or development files containing usernames.
• API endpoints returning usernames without authentication or access control.

Impacts:

• Facilitates Account Compromise: Attackers can focus on known usernames for password attacks.
• Enables Credential Stuffing: Previously leaked or reused credentials can be exploited.
• Social Engineering: Knowing usernames allows targeted phishing or impersonation attempts.
• Reconnaissance: Revealed usernames provide insight into roles, system accounts, or organizational structure.

Detection indicators:

• Login pages providing different error messages for invalid usernames versus passwords.
• Publicly accessible endpoints or files listing usernames.
• Security scanners detecting exposed usernames.

Mitigation focuses on limiting exposure and enforcing secure authentication:

1. Use Generic Login Error Messages
   Avoid specifying whether a username or password is incorrect.

2. Restrict Public Access to User Information
   Ensure that user lists, profiles, or account-related data are only accessible to authorized users.

3. Sanitize Logs and Error Messages
   Avoid writing usernames to publicly accessible logs or error pages.

4. Implement Rate Limiting and Account Lockout
   Protect against brute-force or enumeration attacks targeting disclosed usernames.

5. Encrypt Sensitive Data
   Ensure usernames stored in systems are handled securely and hashed where applicable.

6. Monitor and Audit Access
   Detect repeated attempts to enumerate or access usernames.

7. Security Testing
   Include checks for username disclosure during penetration testing and automated scans.

• CWE 200: Exposure of Sensitive Information
• CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N