D-Link Nuclias Connect firmware versions up to 1.3.1.4 have a vulnerability in the login endpoint that allows unauthenticated attackers to enumerate valid usernames by observing differences in JSON error messages. This information disclosure flaw can aid attackers in identifying valid accounts on the server. A fix is currently under development by D-Link.