If using the authentication form included in Django (contrib.auth.forms.AuthenticationForm), it will use the message "Please enter a correct username and password" if the credentials were wrong, and will use the error message "This account is inactive" if the specified username exists but is not active.

Since these error messages are not customizable, you need to create your own authentication form that displays error messages that satisfy this security requirement.