Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames.
CWE-203