Account Enumeration: How to Find Login and Signup Leaks
Account enumeration happens when an app reveals whether an email, username, or phone is registered. Attackers use that to build target lists for phishing and password spraying.
Many programs still pay for clear, reproducible enumeration on auth flows — especially when messages or timing differ sharply.
Where it shows up
- Login error text (“user not found” vs “wrong password”)
- Signup (“email already registered”)
- Password reset (“if the account exists…”) that lies inconsistently
- Username availability checks on profile creation
- Invite flows that confirm a user is already on the tenant
Testing method
- Pick two addresses: one you registered, one you did not.
- Send identical login/reset/signup requests for both.
- Compare status codes, JSON error codes, HTML strings, and response timing.
- Confirm the difference is stable across a few retries.
Keep volume low. Enumeration proofs need a handful of requests, not a dictionary attack.
Strong vs weak findings
Strong: reliable, automatable difference that discloses registration for arbitrary emails in scope.
Weak: a single vague message that also appears for invalid formats, or a difference only on your own account.
Some products intentionally confirm emails on signup — check the program policy before reporting expected behavior.
Impact language
Explain that attackers can filter valid accounts before credential stuffing or phishing. Tie it to the program’s auth surface (consumer login, SSO email lookup, partner portal).
Remediations to suggest
- Identical messages and status codes for valid vs invalid identifiers
- Constant-time responses where practical
- Rate limits and CAPTCHA on auth endpoints
- Generic reset copy that does not branch in the API
Defensive checklist
- Return the same error body for unknown user and bad password.
- Avoid username/email oracles in public APIs.
- Log enumeration-like traffic patterns.
- Review mobile apps — they often expose clearer API errors than the website.
Enumeration is a privacy and abuse bug. Prove the oracle, keep traffic gentle, and write the impact in attacker workflow terms.
Original Bugflare guide informed by OWASP account enumeration testing guidance.