Username enumeration via authentication response discrepancy

Observable response discrepancy in Siemens Mendix Runtime allows remote attackers to enumerate valid usernames over Basic Authentication. When Basic Authentication validates a supplied username, the affected authentication path returns observably different responses for existing and nonexistent accounts. The issue is reachable without authentication only when an application uses Basic Authentication, and the disclosed account names can support targeted credential attacks.