Username enumeration via distinguishable login responses

Observable response discrepancy in Franka Emika Robot 4.0.3 and earlier allows remote attackers to enumerate valid usernames. The web application's login handler returns “user not found” for nonexistent accounts and “incorrect password” for valid accounts supplied with a wrong password. Unauthenticated network access to the login interface is sufficient; the disclosed usernames can improve brute-force targeting but do not by themselves grant account access.