OpenStack Security Advisory

  1. Bug #1795800
  2. Comment #3

Comment 3 for bug 1795800

Revision history for this message
Andy Ngo (andyngo) wrote : Re: Username enumeration via response timing difference

I tested this in a test env we have here in our company on Identity 3.8. The POST payload was from the API https://developer.openstack.org/api-ref/identity/v3/#password-authentication-with-unscoped-authorization