diff --git a/internal/server/account_test.go b/internal/server/account_test.go
new file mode 100644
index 0000000..06e7b93
--- /dev/null
+++ b/internal/server/account_test.go
@@ -0,0 +1,25 @@
+package server
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestDAVUnknownAccountChallenge(t *testing.T) {
+	s, _, _ := newTestServer(t)
+
+	// 未带任何凭据的未知账号，与“账号存在但未认证”一致：401 + WWW-Authenticate。
+	rec := request(s, "PROPFIND", "/ghost/", "", "", nil, map[string]string{"Depth": "0"})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("未知账号应为 401，实际 %d", rec.Code)
+	}
+	if got := rec.Header().Get("WWW-Authenticate"); got != `Basic realm="davbox"` {
+		t.Fatalf("未知账号应带 WWW-Authenticate，实际 %q", got)
+	}
+
+	// 带任意凭据结果一样，不泄漏账号是否存在。
+	rec = request(s, "PROPFIND", "/ghost/", "ghost", "whatever", nil, map[string]string{"Depth": "0"})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("未知账号（带凭据）应为 401，实际 %d", rec.Code)
+	}
+}
diff --git a/internal/server/server.go b/internal/server/server.go
index a73978b..67b8102 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -75,6 +75,9 @@ func (s *Server) route(w http.ResponseWriter, r *http.Request) {
 				s.handleDAV(w, r, seg)
 				return
 			}
+			// 账号不存在时返回与未认证一致的 401，避免泄漏账号是否存在。
+			writeAuthChallenge(w)
+			return
 		}
 		writeError(w, http.StatusNotFound, "未找到")
 	}