Username enumeration via distinct authentication errors

User enumeration in Kalmia CMS 0.2.0 allows remote attackers to identify valid usernames through unauthenticated login requests. The POST /kal-api/auth/jwt/create endpoint checks whether the submitted user exists before validating the password and returns user_not_found instead of invalid_password when no account matches. No account or user interaction is required, and the response oracle discloses only whether each tested username is registered.