CVE-2024-0391 — The check user account lock states feature within the email

title: Potential User Enumeration via OTP Flow - CVE-2024-0391
id: scw-2026-05-11-ai-1
status: experimental
level: medium
description: |
  Detects requests to an OTP check endpoint that include a username parameter and return a successful status code (200). This specific pattern, when exploited, allows attackers to infer the existence of registered user accounts by observing responses, as described in CVE-2024-0391. This is a key indicator of user enumeration.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2024-0391/
tags:
  - attack.defense_evasion
  - attack.t1078.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/otp/check'
      cs-uri-query|contains:
          - 'username='
      sc-status:
          - 200
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse