A civic identity portal returns "account not found" for some usernames and "invalid password" for others during login attempts the RoE permits. What finding class should the tester report?
Select an answer to reveal the explanation.
Short Explanation
If the site whispers different messages depending on whether the name exists, it is basically confirming the roster for you. That login difference is classic username enumeration—not a full takeover by itself.
Full Explanation
Differentiated login or error responses that confirm whether an account exists enable username enumeration. On civic identity portals this expands the attack surface for credential stuffing and password spraying within whatever the RoE allows. The finding is the information leak itself; it is not XSS, privilege escalation, or an IDOR unless those are separately demonstrated.