Username enumeration via distinct login failure messages

Observable response discrepancy in Antabot White-Jotter 0.2.0 through 0.2.2 allows remote attackers to enumerate valid usernames via /login. The login handler returns “User does not exist” for unknown accounts and “Wrong password” for valid accounts with an incorrect password. No authentication is required, and the disclosed consequence is account-name discovery that can support targeted credential attacks.