Glossary
Account Enumeration
Account enumeration infers which accounts genuinely exist in a system by observing subtle differences in how it responds to valid versus invalid identifiers — a login form that returns 'incorrect password' for a real username but 'account not found' for a fictitious one, for instance, is leaking exactly this distinction even though neither response reveals a password. An attacker can use these differences to build a list of valid accounts to target with further attacks, entirely without ever guessing a single correct credential.
The fix is usually straightforward once the pattern is recognized: making the response to a failed login, a password reset request, or a similar action identical regardless of whether the identifier corresponds to a real account, so the response itself carries no information about which accounts exist.