User enumeration via timing attack – rejected as ‘no security impact’ despite clear proof

I recently reported a user enumeration vulnerability to a responsible disclosure program. Here’s what happened.

The finding:
The password reset endpoint responded with a dramatic timing difference between valid and invalid usernames (valid took ~9 seconds, invalid ~1 second). There was also no rate limiting. An attacker could enumerate all valid usernames with ease.

What I provided:

• Clear steps to reproduce
• curl commands showing the timing difference
• A video PoC demonstrating the attack
• Explanation that user enumeration is a known security weakness (CWE‑204, OWASP)

The program’s response (after 2 months):

My frustration:

• They confirmed the behaviour is real.
• They acknowledged it leaks valid usernames.
• Yet they reject it because it doesn’t immediately lead to account takeover.