Username enumeration via login response timing

Username enumeration in Medicine Tracker System 1.0 allows remote attackers to identify valid accounts via login-response timing. The login handler returns measurably slower responses for valid usernames, with delay increasing as the supplied password grows, creating a timing oracle. No authentication is required; repeated POST requests to app/login.php disclose account names but not passwords or account data.