A web application has a 'forgot password' page that shows 'User not found' for unregistered emails and 'Reset email sent' for registered emails. What security risk does this create?

• A.The different messages are a UX feature; there is no security risk
• B.This is a CSRF vulnerability because the forgot password form doesn't have a CSRF token
• C.The different messages only matter if the site is targeted by nation-state actors
• D.This is a user enumeration vulnerability: an attacker can submit email addresses and use the different responses to build a list of valid accounts, which is then used for credential stuffing, targeted phishing, or GDPR violations (confirming someone has an account); the fix is to always show the same response regardless of whether the email exists