cve.bz

CWE-204: Observable Response Discrepancy

Filter

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

What the weakness is: CWE-204 at MITRE

Related attack patterns (CAPEC): 4
  • CAPEC-331 ICMP IP Total Length Field Probe Likelihood: Medium · Severity: Low
  • CAPEC-332 ICMP IP 'ID' Field Error Message Probe Likelihood: Medium · Severity: Low
  • CAPEC-541 Application Fingerprinting Severity: Low
  • CAPEC-580 System Footprinting Likelihood: Low · Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-204, as MITRE names them. Credits.

Ask an AI about CWE-204

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-204: Observable Response Discrepancy and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/204.html and https://cve.bz/cve/cwe/204?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-97702

    Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requir…

  2. 6.9CVE-2026-122139

    blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset r…

  3. 6.9CVE-2026-119700EPSS 0.4%

    WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaIt…

  4. 7.5CVE-2026-100164EPSS 0.3%

    Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.

  5. 5.3CVE-2026-49442EPSS 0.2%

    Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the applicat…

  6. 5.8CVE-2024-7478EPSS 0.2%

    When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authen…

  7. 6.9CVE-2026-111056EPSS 0.3%

    FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup …

  8. 6.9CVE-2026-111887EPSS 0.3%

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can subm…

  9. 6.9CVE-2026-105664EPSS 0.3%

    The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holdin…

  10. 7.5CVE-2026-14177EPSS 0.2%

    Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.

  11. 5.3CVE-2026-111386EPSS 0.2%

    Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerCo…

  12. 9.1CVE-2026-111235EPSS 0.4%

    An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an upper…

  13. 6.0CVE-2026-110310EPSS 0.5%

    A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known B…

  14. 3.7CVE-2026-103526EPSS 0.3%

    In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Becaus…

  15. 6.9CVE-2026-109206EPSS 0.2%

    LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can suppl…

  16. 5.3CVE-2026-107843EPSS 0.3%

    Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or the …

  17. 5.1CVE-2026-59785EPSS 0.2%

    Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them u…

  18. 6.9CVE-2026-82043EPSS 0.2%

    UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoi…

  19. 7.1CVE-2026-104439EPSS 0.3%

    YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePasse…

  20. 5.3CVE-2026-86778EPSS 0.2%

    Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.

  21. 2.7CVE-2026-102587EPSS 0.2%

    A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view …

  22. 5.3CVE-2026-84717EPSS 0.3%

    A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target t…

  23. 4.1CVE-2026-71462EPSS 0.3%

    StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant …

  24. 5.0CVE-2026-71458EPSS 0.3%

    URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 deta…

  25. 6.9CVE-2026-89173EPSS 0.4%

    Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses.

  26. 5.3CVE-2026-9161EPSS 0.3%

    Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respon…

  27. 7.1CVE-2026-86758EPSS 0.4%

    Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all licen…

  28. 7.5CVE-2026-19205EPSS 0.4%

    Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026.

  29. 7.5CVE-2026-19080EPSS 0.4%

    Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448.

  30. 4.3CVE-2026-78584EPSS 0.3%

    Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a s…

  31. 3.7CVE-2026-84307EPSS 0.5%

    Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAcce…

  32. 6.9CVE-2026-81033EPSS 0.5%

    Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-fou…

  33. 6.9CVE-2026-75575EPSS 0.4%

    Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/…

  34. 7.5CVE-2026-27462EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has…

  35. 8.6CVE-2026-69519EPSS 1.0%

    Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

  36. 6.9CVE-2026-66002EPSS 0.8%

    Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request…

  37. 6.9CVE-2026-54739EPSS 0.6%

    Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. L…

  38. 2.9CVE-2026-19965EPSS 0.5%

    A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. Th…

  39. 5.3CVE-2026-14672EPSS 0.4%

    Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iteration…

  40. 5.3CVE-2026-73306EPSS 0.4%

    Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/…

  41. 5.3CVE-2026-72588EPSS 0.4%

    A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 …

  42. 5.3CVE-2026-55998EPSS 0.3%

    The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemte…

  43. 9.1CVE-2026-60007EPSS 0.6%

    In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa…

  44. 5.3CVE-2026-14202EPSS 0.3%

    Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

  45. 6.9CVE-2026-54768EPSS 0.4%

    WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordRes…

  46. 5.3CVE-2026-42218EPSS 0.4%

    xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on …

  47. 5.3CVE-2024-23574EPSS 0.3%

    HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system. Use renumeration is when a malicious actor can use brute-force techn…

  48. 4.3CVE-2026-47083EPSS 0.3%

    An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Se…

  49. 9.1CVE-2026-15747EPSS 0.2%

    Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, …

  50. 3.7CVE-2026-44753EPSS 0.3%

    SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation …