[Security bug] User name oracle

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • No
• Are you sure you're not using someone else's docker image?
  • ?
• Have you searched for similar issues (both open and closed)?
  • yes

Describe the bug
I am doing a pentest for a customer of mine and I spotted the failed login message No relevant user found which seemed like an oracle . As I couldn't believe this bad practices at least 15 years ago popped up in 2024 I was looking at the code in https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/backend/internal/token.js#L25 it unfortunately confirmed my suspicion. And there are also other hints which should be avoided in the source code.

See https://cwe.mitre.org/data/definitions/204.html, https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/

Nginx Proxy Manager Version
v2.11.1

To Reproduce
see above

Expected behavior
Don't show any hint whether user exists, password is wrong, account is locked or whatsoever, see https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#incorrect-and-correct-response-examples

I hope this full disclosure is fine as I couldn't find another way filing it. Last but not least as the code is public it's pretty obvious.

Start in backend/internal/token.js around line 25, where the reported login error is generated. Trace the responses for an unknown user, an incorrect password, and other account states mentioned in the issue. Done means the login response no longer reveals whether a username exists or why authentication failed.