The Open eClass platform permits unauthenticated users to discover valid usernames by observing differences in the login response. An attacker who can query the login endpoint can determine which account names exist, which can be used to craft targeted phishing or credential-stuffing attacks. The weakness is classified as a username enumeration flaw (CWE‑204).

The vulnerability affects all installations of the Open eClass platform version 4.1 and earlier, released under the Gunet project. Accounts created prior to the 4.2 release are susceptible. Administrators of public or private LMS instances should review the installed version to determine exposure.

This issue has a CVSS score of 5.3, indicating a medium severity impact. The EPSS score is less than 1%, suggesting a very low probability of exploitation. It is not listed in the CISA KEV catalog. Attackers need only access the web login page, so the attack vector is likely remote via HTTP. Because the vulnerability is present only in earlier releases, the risk can be reduced by updating to a patched version.