Summary The V8 OAuth2 password-grant endpoint returns distinct error messages for invalid usernames versus invalid passwords, allowing any unauthenticated attacker to enumerate all valid CRM user accounts Impact This is a username enumeration vulnerability. Any unauthenticated remote attacker can determine which usernames exist in the CRM by sending password-grant requests to the V8 OAuth2 endpoint and observing the differing error messages. This directly enables targeted attacks against confirmed accounts - password spraying, credential stuffing, social engineering, and brute-force. All SuiteCRM 8.x instances exposing the /legacy/Api/V8/OAuth2 endpoint are affected.