CWE-203: Observable Discrepancy, page 4
Filter
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
What the weakness is: CWE-203 at MITRE
Ask an AI about CWE-203
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-203: Observable Discrepancy and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/203.html and https://cve.bz/cve/cwe/203?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 3.7CVE-2025-54999EPSS 0.2%
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possi…
- 6.9CVE-2025-47872EPSS 0.3%
The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registered, or does not exist in the database. Combined with the fact that serial numb…
- 3.7CVE-2025-6011EPSS 0.4%
A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fi…
- 5.3CVE-2025-24391EPSS 0.3%
A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addre…
- 5.3CVE-2023-38327EPSS 0.4%
An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote attackers to enumerate the users of web applications based on server response.
- 7.5CVE-2025-6386EPSS 0.4%
The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file. This vulnerability allows attackers to enumerate valid usernames and guess password…
- 6.9CVE-2025-6056EPSS 0.4%
Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate usernames.
- 5.3CVE-2025-27451EPSS 0.4%
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existi…
- 8.7CVE-2025-40732EPSS 0.3%
user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php
- 5.3CVE-2025-52576EPSS 0.4%
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and ab…
- 2.6CVE-2025-46570EPSS 0.4%
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflect…
- 5.3CVE-2024-47057EPSS 0.3%
SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames. User Enumeration via Timin…
- 2.0CVE-2025-46804EPSS 0.2%
A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available. Affected are older Screen versions, as well as version 5.0.0.
- 4.3CVE-2025-23182EPSS 0.3%
CWE-203: Observable Discrepancy
- 5.3CVE-2025-3939EPSS 0.3%
Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before…
- 4.3CVE-2025-46720EPSS 0.3%
Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mutations by adding additional unique filters. These filters can be used as an orac…
- 5.3CVE-2021-47664EPSS 0.4%
Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames.
- 3.7CVE-2025-32789EPSS 0.4%
EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the pa…
- 6.3CVE-2024-11084EPSS 0.5%
Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists.
- 5.3CVE-2025-0361EPSS 0.3%
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuratio…
- 5.3CVE-2025-31124EPSS 0.5%
Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the …
- 6.5CVE-2024-51477EPSS 0.3%
IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable response discrepancy.
- 7.5CVE-2024-13939EPSS 0.4%
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equa…
- 3.7CVE-2025-30344EPSS 0.3%
An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashin…
- 7.5CVE-2025-1468EPSS 0.6%
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
- 5.8CVE-2025-29780EPSS 0.2%
Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `feldman_vss` library contains timing side-channel vulnerabili…
- 3.7CVE-2024-41760EPSS 0.3%
IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA operations.
- 9.8CVE-2025-27667EPSS 0.7%
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-0011.
- 5.3CVE-2025-24023EPSS 0.3%
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This …
- 7.5CVE-2024-41335EPSS 0.5%
Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 28…
- 6.9CVE-2023-37482EPSS 0.5%
The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid …
- 4.3CVE-2024-45089EPSS 0.3%
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition EBICS server could allow an authenticated user to obtain sensitive filename information due to an observable discrepancy.
- 5.3CVE-2025-24506EPSS 0.2%
A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.
- 5.3CVE-2023-37413EPSS 0.3%
IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy.
- 5.1CVE-2024-7881EPSS 0.2%
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an address that is also dereferenced.
- 4.3CVE-2023-47159EPSS 0.3%
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable discrepancy in request responses.
- 5.3CVE-2024-35114EPSS 0.4%
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.
- 5.1CVE-2024-10929EPSS 0.2%
In certain circumstances, an issue in Arm Cortex-A57, Cortex-A72 (revisions before r1p0), Cortex-A73 and Cortex-A75 may allow an adversary to gain a weak form of control over the victim's branch history.
- 7.8CVE-2024-43095EPSS 0.08%
In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed fo…
- 7.5CVE-2025-21510EPSS 0.7%
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker wit…
- 5.3CVE-2025-24011EPSS 1.6%
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of…
- 5.6CVE-2025-21336EPSS 0.7%
Windows Cryptographic Information Disclosure Vulnerability
- 5.3CVE-2024-36510EPSS 0.7%
An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all versions, 7.0 all versions, 6.4 all versions …
- 3.7CVE-2024-42174EPSS 0.3%
HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames.
- 6.3CVE-2024-13198EPSS 0.7%
A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack…
- 7.5CVE-2024-54767ExploitEPSS 1.8%
An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and …
- 6.3CVE-2024-13028EPSS 0.8%
A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the file /login. The manipulation of the argument username leads to observable response…
- 5.3CVE-2024-56738EPSS 0.4%
GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
- 5.3CVE-2024-54454EPSS 0.4%
An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy vulnerability in the sendPasswordReinitLink action of the unlogged.do page allo…
- 5.5CVE-2024-47150EPSS 0.1%
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.