Why can leaking a raw exception message in a security error response be dangerous?

A raw stack trace or exception message can reveal internal details — class names, SQL fragments, whether a username exists at all (letting an attacker enumerate valid accounts by comparing 'user not found' vs 'wrong password' responses). Production error handlers should return a generic, consistent message for authentication failures regardless of the specific internal cause.