From 9dc798b3a5c0edd1e224158cd91d8e8e9b84df96 Mon Sep 17 00:00:00 2001
From: beanbeah <24713371+beanbeah@users.noreply.github.com>
Date: Sun, 9 Aug 2026 06:16:48 -0700
Subject: [PATCH] fix: remove username/password enumeration from login error
 messages

POST /users/v1/login previously returned two distinguishable error
messages in the vulnerable branch: 'Username does not exist' when the
username was not found, and 'Password is not correct for the given
username' when it was found but the password did not match. This let
an attacker enumerate valid usernames and use the login endpoint as a
password oracle.

Now both failure cases return the same generic 'Username or Password
Incorrect!' message, matching the pattern used elsewhere in the code
for the non-enumerable case, so the response no longer leaks whether
the supplied username exists.
---
 api_views/users.py | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/api_views/users.py b/api_views/users.py
index 172540a..c985509 100644
--- a/api_views/users.py
+++ b/api_views/users.py
@@ -98,16 +98,12 @@ def login_user():
                 'auth_token': auth_token
             }
             return Response(json.dumps(responseObject), 200, mimetype="application/json")
-        if vuln:  # Password Enumeration
-            if user and request_data.get('password') != user.password:
-                return Response(error_message_helper("Password is not correct for the given username."), 200,
-                                mimetype="application/json")
-            elif not user:  # User enumeration
-                return Response(error_message_helper("Username does not exist"), 200, mimetype="application/json")
-        else:
-            if (user and request_data.get('password') != user.password) or (not user):
-                return Response(error_message_helper("Username or Password Incorrect!"), 200,
-                                mimetype="application/json")
+        # Always return a single, generic failure message regardless of whether the
+        # username exists or the password was wrong, so a caller cannot use the
+        # response to enumerate valid usernames or confirm passwords via an oracle.
+        if (user and request_data.get('password') != user.password) or (not user):
+            return Response(error_message_helper("Username or Password Incorrect!"), 200,
+                            mimetype="application/json")
     except jsonschema.exceptions.ValidationError as exc:
         return Response(error_message_helper(exc.message), 400, mimetype="application/json")
     except: