Account Enumeration

Account enumeration occurs when an application reveals whether a username or email is registered through different responses to valid vs invalid accounts.

Login enumeration:

# Vulnerable: different messages for valid vs invalid username
def login(username, password):
    user = db.find_user(username)
    if not user:
        return "Username not found"  # Reveals: username does NOT exist
    if not verify_password(password, user.password_hash):
        return "Incorrect password"  # Reveals: username DOES exist
    return "Login successful"

Password reset enumeration:

POST /reset-password
Email: [email protected] → Response: "Email address not found"
Email: [email protected]  → Response: "Reset link sent to your email"

An attacker can build a list of valid emails/usernames by automating these requests and observing the response differences. This enables targeted phishing and credential stuffing.

The fix is to return identical responses regardless of whether an account exists. This denies attackers the feedback they need to confirm account validity.

Generic login response:

def login(username, password):
    user = db.find_user(username)
    # Always use constant-time comparison and same error
    if not user or not verify_password(password, user.password_hash if user else DUMMY_HASH):
        return "Invalid username or password"
    return generate_token(user)

# IMPORTANT: verify_password must run even when user is None
# to prevent timing-based enumeration (fast "no user" vs slow "wrong password")
DUMMY_HASH = bcrypt.hashpw(b"dummy", bcrypt.gensalt())

Generic reset response:

def request_password_reset(email):
    user = db.find_user_by_email(email)
    if user:
        token = generate_reset_token()
        send_reset_email(email, token)
    # Always return the same message
    return "If an account exists for this email, a reset link has been sent."

Defense checklist:

• Same error message for invalid username and invalid password
• Run password hashing even for non-existent users (prevent timing attacks)
• Same reset response whether or not email is registered
• Rate limit enumeration attempts