Account enumeration via login timing discrepancy

Username enumeration in affected Liferay Portal and DXP releases allows remote attackers to identify valid accounts through login timing. The authentication path performs unequal password-hash work for existing and nonexistent users, leaving their response times distinguishable. No authentication or user interaction is required, and the disclosed consequence is limited to learning whether submitted account names exist.