Skip to content
OpenAdvisories

Weakness (CWE)

CWE-204: Observable Response Discrepancy

Base Incomplete

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

  2. Implementation

    Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.

    If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.

    Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.

Source: MITRE CWE-204

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-26744 Public exploit

    A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible …

  • Medium 4.3
    CVE-2026-24332 Public exploit

    Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actua…

    Discord WebSocket API service
  • Medium 5.3
    CVE-2025-65899 Public exploit

    Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application ret…

  • Medium 5.3
    CVE-2025-56764 Public exploit

    Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning…

  • Medium 6.5
    CVE-2025-46047 Public exploit

    Silverpeas Core Username Enumeration Vulnerability

    A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.

    org.silverpeas.core:silverpeas-core Maven
  • Medium 5.3
    CVE-2024-39211 Public exploit

    Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response…

  • Medium 5.3
    CVE-2019-19030 Public exploit

    Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)

    Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.

    github.com/goharbor/harbor Go