Username enumeration via distinct login responses

Observable response discrepancy in ZimaOS 1.2.4 and earlier allows remote attackers to enumerate valid usernames through its login API. The /v1/users/login endpoint returns code 10006 for an unknown username but 10013 for a valid username paired with a wrong password. No authentication or user interaction is required; disclosed account names enable targeted credential stuffing or password brute-forcing.