Shopware Store API Login Responses Enable User Enumeration

Root Cause

The Store API login route allowed CustomerNotFoundException and BadCredentialsException to propagate as different serialized API responses. Unknown users received CHECKOUT__CUSTOMER_NOT_FOUND while real users with the wrong password received CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS.

Shopware already handled this case safely in the storefront controller by normalizing both exceptions. The Store API path skipped that normalization, so the API leaked account existence even though the application clearly had the correct defensive pattern elsewhere.

Weaknesses