I am doing an audit on a website, and discovered that you could create different accounts with the same username, but different passwords.
an user 'a' with password 'a' will have a different account than user 'a', but with password 'b'.
I have the feeling that this behavior is wrong, but I don't clearly see what is the risk in doing so.
There is no account recovery system on the website for now.
login failure says "wrong username or password", so it doesn't disclose existing users.
Could you explain me what are the risks of providing this behavior?