Telling somebody which half of their login was wrong is a genuinely better experience, and it is why this defect keeps getting written. It is also an oracle: anybody can ask your application whether an address has an account, as many times as they like, and get a straight answer.
What that is worth depends on what your application is. For a bookshop, not much. For a service somebody might not want to be known to use, it is the whole breach.
POST /sessionAn address that exists, with the wrong password.
POST /sessionAn address that does not. Compare the two pairs.
A witness for this class is necessarily two requests, because a single response is not evidence of anything — the finding is that two responses differ when they should not. The console will let you send a sequence, and the engine compares the pair.
Registration and password reset are the two other endpoints with the same problem, and they are usually worse: a reset form that says 'we have sent you an email' either way is the pattern to copy.