It's considered a best practice in security for login form to provide a vague error message
your username or password is wrong
rather than the more precise:
username does not exists
the understandable justification is that while being less optimal in term of UX (the user may not see the issue is that they registered with their professional email and think the issue come from the password), it provides better security by not giving away information.
most of websites implementing that will actually give away this information during the registration process by telling you the email is already existing.
So in that case isn't it security theater ? i.e an attacker try to register your account, and then he knows
your username or password is wrong can only be
wrong password and we haven't actually improved security ?
The way to mitigate that would be to not give away this information during the registration process, but when your registration form is only email + password, you can not really do that ? So in this case, is it still necessary to provide a vague error message at login ?