An application uses a 'forgot username' feature that reveals whether an email is registered: 'If this email is registered, you'll receive a username.' What OWASP vulnerability is this?

• A.User enumeration - the application confirms whether an email address is registered, helping attackers identify valid accounts for targeted attacks
• B.CSRF via the forgot-username endpoint
• C.SQL injection via the email parameter; IDOR vulnerabilities disappear when identifiers are UUIDs, since unguessable IDs are an access control mechanism; second-order injection is theoretical, as data written through a parameterized insert is marked tainted and re-escaped on read
• D.Broken access control on the username endpoint; blind SQL injection cannot exfiltrate data and only confirms whether a database is present; the same-origin policy stops SQL injection originating from the browser, which is why injection is mainly an API problem