Login messages must not disclose account state

Control Statement: The login screen must not disclose whether an account exists, is locked, or was presented with an incorrect password.

Description: Two system settings control the detail shown on a failed login: DisplayAccountLockoutMessageAtLogin, which states that the account is locked, and DisplayIncorrectPasswordMessageAtLogin, which states that the password was incorrect. This control requires both to be disabled, so that a failed login returns an indistinguishable response regardless of cause. Creatio’s own guidance recommends false for both.

Rationale: Distinguishable failure messages let an unauthenticated party test which accounts exist. “Incorrect password” confirms the account is real; a generic failure does not. That distinction converts the login screen into an account enumeration oracle, and a confirmed list of valid accounts is the input to every subsequent credential attack — it makes password spraying efficient and gives a phishing campaign a verified target list. A lockout message adds a second signal, revealing which accounts are already under attack and when the lock will lift.

Audit Procedure:

1. Open System Designer → System settings.
2. Record the configured values of DisplayAccountLockoutMessageAtLogin and DisplayIncorrectPasswordMessageAtLogin.
3. Record the instance as non-compliant if either is enabled.
4. Confirm the behaviour directly: attempt a login with a known-valid account and an incorrect password, and with an account that does not exist, and confirm the responses are indistinguishable.

Remediation:

1. Set both settings to false.
2. Re-run the two login attempts in step 4 of the audit procedure and confirm the responses no longer differ.
3. Where a support process relies on users reporting the specific message they saw, update it before making the change.

Default Value: Creatio’s guidance recommends false for both settings, which indicates they are not reliably false before configuration. Verify the behaviour on the instance rather than assuming disclosure is off.