An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
CWE-204