GHSA-q3x8-6898-23g3: ibexa/user login enumerates user accounts

The vulnerability described is a user enumeration issue in the login functionality of ibexa/user. The provided information indicates that error messages were too specific, allowing an attacker to determine if a user account exists. The patch was identified by comparing the git tags for the last vulnerable version (v5.0.2) and the first patched version (v5.0.3). The relevant commit b7c88ec4492b8be98acc5bfb2e4708334157a5e2 has the message "IBX-10654: Made authorization error messages less verbose", which directly relates to the vulnerability description.

The analysis of this commit shows a modification in the onAuthenticationFailure method of the DefaultAuthenticationFailureHandler class. The change involves intercepting a BadCredentialsException and replacing its message with a generic "Bad credentials." message. This prevents the application from leaking information about the validity of a username during a failed login attempt. Therefore, the onAuthenticationFailure function is the key vulnerable function, as it was responsible for handling and exposing the detailed error messages that led to the user enumeration vulnerability.