Username enumeration via skipped password hashing

Observable timing discrepancy in Django 4.2 before 4.2.14 and 5.0 before 5.0.7 allows remote attackers to enumerate usernames via login requests. ModelBackend.authenticate() calls verify_password(), which returned immediately for an unusable stored password instead of performing the default password-hasher work used for a nonexistent user. Unauthenticated access to an application login endpoint and repeated timing measurements are required; the bounded result is disclosure of valid account names.