Account enumeration
Finding out which emails are registered from differences in error messages or responses.
Definition
If login says "No account with this email" for one address and "Wrong password" for another, an attacker learns who has an account. Login, sign up and password reset should give the same generic response either way.
In practice
"If an account exists for this email, we've sent a reset link" is safe. "This email is not registered" is not.
Learn it in context
Lessons that use this term.