Why is it dangerous to return the raw exception message from a login endpoint?

Detailed messages like 'no account found for this email' versus 'incorrect password' let an attacker distinguish between a non-existent account and a wrong password — enabling user enumeration, where an attacker can build a list of valid registered emails/usernames purely from response differences. Best practice: return one generic message for all authentication failures, and log full detail only on the server.