CVE-2025-9824 — ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force — CVE Database · The Intelligence Room