YaBB version 1, SP 1.3.1, leaks whether or not a username is valid when an invalid password is given.