A flaw in the OpenShift Mirror Registry lets an unauthenticated attacker discover existing usernames and email addresses by receiving different error responses during login attempts or account creation. The disclosed information (CWE‑209) can be used to plan credential‑guessing or social‑engineering attacks, but it does not provide direct access to data or code execution.

The vulnerability affects Red Hat Mirror Registry for OpenShift and its second version, as sold and maintained by Red Hat. All known releases of these products are potentially impacted; specific version ranges are not detailed in the advisory.

The CVSS base score of 5.3 places the issue in the moderate severity range. No EPSS score or KEV listing is available, suggesting the risk is not currently high from a deployment‑level viewpoint. The attack vector is remote and unauthenticated, requiring no special credentials. Any host that can reach the Mirror Registry service can enumerate valid users, increasing the likelihood of subsequent targeted credential attacks. The information revelation remains the primary impact, though it lays groundwork for more serious exploits if attackers combine it with other weaknesses.