Maybe you can rename this to authenticate instead as calling the function User::authenticateUser seems redundant. User::authenticate() looks better.

Also, I think it's better to do 
if (!$row) {
    throw new NotFoundException;
}
return new self($row);

then you can do try { } catch(NotFoundException $e) in your login() function in controller. If username and password is incorrect, it will throw an exception which means, the login failed.