🎄 Join our Annual Holiday wargame and win prizes!


User Enumeration

User enumeration is a security vulnerability where an attacker can determine valid usernames by interacting with a system's authentication or registration processes. This often occurs because the system provides distinct error messages, status codes, or response times for valid and invalid usernames. By exploiting these discrepancies, an adversary can systematically identify existing accounts, which can then be targeted with brute-force, credential stuffing, or social engineering attacks.

Remediation

  • Ensure authentication and registration responses are uniform regardless of whether a username exists. For example, always return a generic message such as "Invalid username or password."
  • Apply rate limiting, CAPTCHA, and throttling mechanisms to make automated enumeration attacks impractical.
  • Implement account lockout or progressive delays after repeated failed login attempts to further slow attackers.
  • Monitor authentication endpoints for abnormal activity, such as high volumes of failed login attempts from the same IP address.

Metadata

  • Severity: low
  • Slug: user-enumeration

CWEs

  • 204: Observable Response Discrepancy
  • 209: Generation of Error Message Containing Sensitive Information

OWASP

  • A07:2021: Identification and Authentication Failures

Available Labs

Select a language to explore available labs for this vulnerability.

No matching labs found

Try adjusting your language filter.

Deco line
Deco line

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now
Deco line
Deco line

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.

Read more