A failed login can reveal whether an account exists

A failed login can reveal information about an account.

Imagine entering an email address on a website and getting this message:

"Account does not exist."

Now try a different email address:

"Incorrect password."

You've just discovered which email address has an account on that website.

This vulnerability is called username enumeration.

Attackers can use it to identify valid accounts for targeted phishing or password attacks.

Quick security test for your own website

1. Try logging in with a registered email and an incorrect password.
2. Try again with an unregistered email.
3. Compare the messages and response behaviour.

The fix: Use consistent messages such as "Invalid email or password" and apply rate limiting.

The takeaway: Even failed login attempts can leak useful information.