Username enumeration via differentiated login responses

Observable response discrepancy in funnyzpc Mee-Admin 1.0 through 1.6 allows remote attackers to enumerate valid usernames via /mee/login. The login endpoint returns a distinct response when the supplied username does not exist, allowing failed attempts to be compared with responses for valid accounts. No authentication is required; disclosure is limited to account existence, which supports targeted password attacks.