Crucible users can configure their own avatars. Due to the fact that avatars endpoint was giving different responses for existing and non-existing users, it could have been used to perform account enumeration to get a list of valid usernames.

In the fix the avatar service now returns same responses for existing and non-existing users.