Username enumeration via distinct login failure messages

Observable discrepancy in WebCalendar before 1.2.7 allows remote attackers to enumerate valid usernames through failed login attempts. The login interface returns a specific reason, such as "no such user," for an unknown account instead of presenting an indistinguishable failure response. No authentication is required; the disclosed account validity can support targeted password attacks but does not itself expose passwords or bypass authentication.