Unauthenticated username enumeration via login timing

Username enumeration in PlexTrac before 1.28.0 allows remote attackers to identify valid unlocked users through login timing. The login path performs extra password-verification work for existing accounts, so failed requests for valid users take measurably longer than requests for nonexistent users. No authentication is required, but only unlocked accounts using the PlexTrac authentication provider are distinguishable, and network jitter can reduce reliability.