Back to Common risks

Common risksLogin and accounts

Different error messages for login tell attackers which emails exist

Your login page returns one message when the email is unknown and a different message when the password is wrong. That sounds helpful. It also tells strangers which addresses are registered before they try to guess passwords.

What can go wrong

A typical AI-generated auth handler returns distinct strings:

  • Unknown email → a message that the user does not exist or the email is not registered
  • Wrong password → a message that the password is wrong or incorrect

An attacker can script login attempts with a list of emails. Different responses become a harvest list of valid accounts. The next step is password spraying or targeted phishing against addresses you confirmed exist.

The fix is not hiding the UI message only. The API response must use the same generic error for both failure paths, for example a single invalid-credentials message.

It happened for real

Practitioner writeups in 2026 call this a recurring auth mistake in AI-generated code: distinct failure strings in the same handler (DEV bezael Problem 2 cluster). Password-reset flows that leak whether an email is registered vs whether a token is wrong create the same harvesting shape.

How to check yours

Seatbelt flags this automatically (partial). Repo scans soft-flag login when the same auth handler contains both user-not-found and wrong-password literals. URL Ship Read catches the pattern in served login bundles too.

Honest holes: middleware-only auth, framework defaults we cannot see statically, or errors built from runtime variables may slip through. A soft flag means read the handler yourself.

Ask your agent: "Show every login and forgot-password error path. Do unknown-user and wrong-password return the same JSON message and status code?"

Manual check: try a random email and a known email with a wrong password. If the messages differ, you are leaking registration state.

Fix direction

Return one generic message for both paths: the same invalid-credentials wording (or identical JSON shape). Log the real reason server-side only.

Paste into your agent: "Unify login failure responses. Same status code and message for both failure paths. Never reveal whether the email exists."

Related risks

withseatbelt-risk-auth-account-enumeration

# product
name      Seatbelt
tagline   Security at the speed of your agent
what      A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method    Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings  /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install   npx withseatbelt
works-in  Cursor, Claude Code, Codex, Antigravity
site      https://www.withseatbelt.com
contact   hello@withseatbelt.com

# current-page
path         /risks/auth-account-enumeration
title        Different login errors tell attackers which emails exist · Seatbelt risk reference
description  Different messages for unknown email vs wrong password confirm which addresses are registered.

# risk
slug      auth-account-enumeration
title     Different login errors tell attackers which emails exist
summary   Different messages for unknown email vs wrong password confirm which addresses are registered.
surface   Login and accounts
coverage  covered (whether the Seatbelt scan gates on this risk)
verified  2026-07-21
related   /risks/idor-url-id-change, /risks/whole-table-in-browser
note      The full entry text is the human view of this page.

# pages
/                   Seatbelt home
/get-started        install: npx, the /seatbelt skill, or MCP
/pricing            every price, in USD, before tax
/app                scan a URL in the browser
/how-it-works       the method: what the scan reads, and how a check earns its place
/before-you-launch  pre launch checklist
/risks              common risks in AI-built apps
/commands           command reference
/labs               measured security research, and notes on how we build
/aiuc-1             Seatbelt as the output-scanning layer for AIUC-1
/supervision        commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security           how we handle your code and data
/privacy            privacy policy
/terms              terms, incl. what a clear report does and does not claim
/refund             refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
  deterministic, so a published number can be re-run without asking us.