CVE-2020-11576

CVE-2020-11576 affects Argo CD (v1.5.0) with a user-enumeration flaw in the /api/v1/session endpoint, which returned 401 for existing usernames and 404 for non-existing ones. This behavior allowed enumeration of valid (non-SSO) usernames. The issue is fixed in v1.5.1; upgrading to v1.5.1 or later...