An unauthenticated attacker can check the existence of usernames in the system by querying an API.
CWE-639