Username enumeration via distinct login failure responses

Observable response discrepancy in Mtons Mblog 3.5.0 allows remote attackers to enumerate valid usernames through the login endpoint. The login handler returns “用户不存在” for an unknown username but “用户认证失败” for an existing username paired with a wrong password. No authentication is required; the discrepancy discloses account names that can focus password guessing without granting access by itself.