The vulnerability in the Rucio WebUI allows an unauthenticated user to learn whether a username exists by receiving distinct error messages during login. This reflects improper error handling (CWE‑204). Based on the description, an attacker could use this information to focus credential‑stuffing or social‑engineering attempts, but the flaw itself does not grant bypass or direct access to protected resources. The issue only exists in the login response; no authentication bypass or arbitrary command execution occurs.

The issue affects the Rucio data‑management framework prior to release 35.8.3, 38.5.4, and 39.3.1. Versions 35.8.3, 38.5.4, and 39.3.1 (and later) contain the fix.

The CVSS score is 5.3, indicating a moderate impact. EPSS is less than 1%, suggesting a low exploitation probability for the current moment. The vulnerability is not listed in CISA’s KEV catalog. An attacker could exploit it by sending unauthenticated HTTP requests to the login endpoint and observing the error messages to enumerate usernames. The vector is most likely remote over HTTP/HTTPS, but no additional prerequisites are required.