Lemmy’s login endpoint previously returned distinct HTTP status codes based on whether a supplied username or email existed. If an account was nonexistent the service returned a 404 error, whereas an existing account with an incorrect password yielded a 400 error. This differential caused the login API to expose information about registered users, permitting an attacker to confirm the existence of usernames or email addresses without credentials. The vulnerability is a classic information disclosure through error response, mapped to CWE‑204, and does not allow arbitrary code execution or privilege escalation. The potential impact is the compromise of account enumeration for credential stuffing or social engineering, affecting confidentiality of user identities and potentially leading to targeted attacks.

The affected product is LemmyNet’s Lemmy. Versions prior to 0.19.19 and 1.0.0‑beta.1 are vulnerable. No specific sub‑components or operating systems are listed beyond the Lemmy codebase authentication endpoint.

The CVSS score of 6.9 classifies the issue as moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote over the network, as the login endpoint is publicly accessible. An unauthenticated attacker can repeatedly request the login endpoint with arbitrary usernames or emails, observing the differing HTTP status codes. No exploitation requires special privileges or code execution. The overall risk is moderate, with a tangible threat to user privacy and potential stepping stone to further attacks.