I have a registration login process which includes a one-time activation link sent via email when the user registers. When the user clicks the link the account get's activated.
Now what error message should/can i show to the user when he tries to login with valid credentials but the account not yet activated via this one-time link? Can i show him an informative message the he needs to activate his account via the link from the mail? Or is this dangerous because it suggests that the credentials are valid?