EIP-2026-118348

This writeup describes an information disclosure vulnerability in Cerberus FTP Server where invalid usernames are handled in a way that leaks valid usernames. The example demonstrates how an attacker can enumerate valid usernames by observing the server's response.