Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? 

I recently tried logging into facebook and misspelled my email. They prompted me with the message below.


  Log in as {username}
  
  {email}@gmail.com · Not You?
  
  Please Confirm Password It looks like you entered a slight misspelling
  of your email or username. We've corrected it for you, but ask that
  you re-enter your password for added security.


I know usernames aren't really a secret but when a website fixes a misspelling to a correct one, they seem to be taking the 'not a secret' a little too far.

As you said, you saw this on facebook - so I tried these steps:


Login with lukas@gmail.com and real password -> works
Login with lukas@gmail.cmo and real password -> works, too (!)
Login with luksa@gmail.com and real password -> also works
Login with luksa@mail.com and real password -> also works
Login with lukas@gmail.cmo and wrong password -> Wrong password, but email got automatically corrected to the right email
Login with lukas@gmail.cmo in a private tab (or a browser with cleared cache & cookies) -> "The email you’ve entered doesn’t match any account"


As the correction only seems to work when I have already successfully logged into FB at this PC,  I would say that this is not a vulnerability in facebook.



Edit: Added new test cases; thanks Zymus, simbabque and Micheal Johnson for the suggestions
