Microsoft Active Directory Federated Services (ADFS) suffers from a time-based user enumeration vulnerability.