Preventing username enumeration
Summary: PortSwigger Research notes that preventing username enumeration requires identifying all relevant attack surface, not just the main login but also account registration, password change, and account recovery, since applications often block enumeration at login while allowing it trivially elsewhere. The article states that eliminating enumeration means checking every aspect of application behavior, including subtle differences in HTML source across code paths and timing differences from different database queries and computational operations for valid versus invalid usernames.
What's compelling: An attacker only needs one weak point to confirm which usernames are valid, and the article notes that CAPTCHA controls and other hurdles on registration may slow the process but do not prevent it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026