User enumeration is discovering which user identities or accounts are registered in a system. It becomes a risk when an authentication flow reveals whether a submitted username or email exists. section 4.4
Multistep login flow
A login flow first asks for a username or email. If it is unregistered, the system prompts the visitor to create an account; if registered, it continues to request a password. Without strong threat detection support, this difference lets threat actors identify registered accounts. section 4.4
Enumeration exposes useful identity information and can support attacks such as credential stuffing, where leaked credentials are tried against accounts on another website. Threat detection is therefore important when designing or operating multistep login flows. section 4.4
