CWE-204 · Observable Response Discrepancy

175 CVEs classified under CWE-204 (Observable Response Discrepancy). Browse by severity and year.

Top CVEs for CWE-204
CVESeverityScorePublishedSummary
CVE-2018-25350Critical9.82026-05-23userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to th…
CVE-2026-15747Critical9.12026-07-14Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token gener…
CVE-2025-5485High8.62025-06-12User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malici…
CVE-2026-33419High7.52026-03-24MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentit…
CVE-2025-12455High7.52026-03-13Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.   The vulnerability could lead to Password Brute Forcing in V…
CVE-2025-46390High7.52025-08-06CWE-204: Observable Response Discrepancy
CVE-2025-3092High7.52025-06-24An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
CVE-2021-20049High7.52021-12-23A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server res…
CVE-2021-34580High7.52021-10-27In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted…
CVE-2026-60007High7.42026-08-04In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentica…
CVE-2026-4113High7.22026-04-09An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
CVE-2026-34264Medium6.52026-04-14During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low…
CVE-2025-67874Medium6.52025-12-16ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent…
CVE-2025-66307Medium6.52025-12-01This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta…
CVE-2025-61907Medium6.52025-10-16Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could a…
CVE-2023-46170Medium6.52024-03-07IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating fi…
CVE-2022-39315Medium6.52022-10-25Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with use…
CVE-2021-38476Medium6.52021-10-19InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This m…
CVE-2024-28232Medium6.22024-04-01Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vu…
CVE-2024-24766Medium6.22024-03-06CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed…
All CVEs classified under CWE-204 — newest first (page 1 of 2)
CVESeverityScorePublishedSummary
CVE-2026-14672Medium5.32026-08-13Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM itera…
CVE-2026-73306Medium5.32026-08-12Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/ap…
CVE-2026-72588Medium5.32026-08-10A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address…
CVE-2026-55998Medium5.32026-08-05The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that ha…
CVE-2026-60007High7.42026-08-04In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentica…
CVE-2026-14202Medium5.32026-08-04Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. …
CVE-2026-547682026-07-31WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticat…
CVE-2026-42218Medium5.32026-07-20xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in respon…
CVE-2024-23574Medium5.32026-07-17HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in…
CVE-2026-47083Medium4.32026-07-16An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authentica…
CVE-2026-15747Critical9.12026-07-14Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token gener…
CVE-2026-44753Low3.72026-07-14SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling…
CVE-2026-61503Medium5.32026-07-13Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote una…
CVE-2026-53422Medium4.32026-07-02Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and di…
CVE-2026-53908Medium4.32026-07-01MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid u…
CVE-2026-53947Medium5.32026-06-24Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an un…
CVE-2026-544452026-06-17vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `r…
CVE-2026-439262026-06-04FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-passwo…
CVE-2026-45294Medium5.32026-05-29FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct resp…
CVE-2026-45620Medium5.32026-05-29WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard…
CVE-2018-25350Critical9.82026-05-23userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to th…
CVE-2026-44306Medium5.32026-05-12Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether…
CVE-2024-0391Medium5.32026-05-11The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered us…
CVE-2026-8242Low3.72026-05-10A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. The impacted element is the function doAction of the component Login RMI Inte…
CVE-2026-20195Medium5.32026-05-06A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user accounts on an affe…
CVE-2026-34319Medium5.02026-04-21Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a…
CVE-2026-24468Medium5.32026-04-20OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.11…
CVE-2026-40485Medium5.32026-04-18ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishabl…
CVE-2026-34264Medium6.52026-04-14During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low…
CVE-2026-4113High7.22026-04-09An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
CVE-2026-39851Medium4.32026-04-08Saleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, the requestEmailChange() mutation was revealing the existence…
CVE-2025-67807Medium4.72026-04-01The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions…
CVE-2025-67806Low3.72026-04-01The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions…
CVE-2025-37162026-03-30User enumeration in ESET Protect (on-prem) via Response Timing.
CVE-2026-33419High7.52026-03-24MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentit…
CVE-2026-33323Medium5.32026-03-24Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages…
CVE-2026-33688Medium5.32026-03-23WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `objects/userRecoverPass.php` performs us…
CVE-2026-30876Medium5.32026-03-16Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has be…
CVE-2025-69243Medium5.32026-03-16Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid…
CVE-2025-13460Medium5.32026-03-16IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.
CVE-2026-2859Medium4.32026-03-13Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate exi…
CVE-2026-24097Medium4.32026-03-13Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate exist…
CVE-2025-12455High7.52026-03-13Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.   The vulnerability could lead to Password Brute Forcing in V…
CVE-2026-4045Low3.72026-03-12A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php. Executing a manipulation of the argum…
CVE-2026-31901Medium5.32026-03-11Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verificati…
CVE-2026-31888Medium5.32026-03-11Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error cod…
CVE-2026-28358Medium5.32026-03-02NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered a…
CVE-2026-28288Medium5.32026-02-27Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an atta…
CVE-2026-25138Medium5.32026-02-25Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior t…
CVE-2025-62512Medium5.32026-02-24Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo…
CVE-2026-27480Medium5.32026-02-21Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. In versions 2.1.0 through 2.40.1, a timing-based username enu…
CVE-2026-26744Medium5.32026-02-19A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The applicati…
CVE-2019-25338Medium5.32026-02-12DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. A…
CVE-2026-25509Medium5.32026-02-03CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version…
CVE-2026-24664Medium5.32026-02-03The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability al…
CVE-2026-24332Medium4.32026-01-22Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a W…
CVE-2026-23511Medium5.32026-01-15ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login inter…
CVE-2026-21484Medium5.32026-01-03AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea…
CVE-2025-69413Medium5.32026-01-01In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
CVE-2025-67874Medium6.52025-12-16ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent…
CVE-2025-62181Medium5.32025-12-10Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a differe…
CVE-2025-67500Low3.72025-12-10Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9…
CVE-2021-477172025-12-09IntelliChoice eFORCE Software Suite 2.5.9 contains a username enumeration vulnerability that allows attackers to enumerate valid users by exploiting the 'ctl00…
CVE-2025-40806Medium5.32025-12-09A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguis…
CVE-2025-65899Medium5.32025-12-04Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invali…
CVE-2025-12994Medium5.32025-12-04Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to dete…
CVE-2025-66307Medium6.52025-12-01This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta…
CVE-2025-59116Medium5.32025-11-18Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login i…
CVE-2025-25236Medium5.32025-11-12Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as t…
CVE-2025-62236Medium5.32025-10-23The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote…
CVE-2025-341552025-10-23Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based…
CVE-2025-34255Medium5.32025-10-16D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint retu…
CVE-2025-34254Medium5.32025-10-16D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Login' endpoint returns distin…
CVE-2025-61907Medium6.52025-10-16Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could a…
CVE-2025-61789Medium5.32025-10-16Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom v…
CVE-2025-42903Medium4.32025-10-14A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of perso…
CVE-2025-58586Medium5.32025-10-06For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin…
CVE-2025-56764Medium5.32025-09-29Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user…
CVE-2025-58442Medium5.32025-09-09Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may r…
CVE-2025-9824Medium5.92025-09-03ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after whi…
CVE-2025-9109Low3.72025-08-18A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email…
CVE-2025-46390High7.52025-08-06CWE-204: Observable Response Discrepancy
CVE-2025-54834Medium5.32025-07-31OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check fo…
CVE-2025-52899Medium5.32025-07-29Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99…
CVE-2025-54129Medium4.32025-07-21HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application re…
CVE-2025-27451Medium5.32025-07-03For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin…
CVE-2025-3092High7.52025-06-24An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
CVE-2025-5485High8.62025-06-12User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malici…
CVE-2025-49187Medium5.32025-06-12For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin…
CVE-2025-0163Medium5.32025-06-11IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepa…
CVE-2025-3939Medium5.32025-05-22Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX a…
CVE-2025-48015Low3.72025-05-20Failed login response could be different depending on whether the username was local or central.
CVE-2024-51447Medium5.32025-05-13A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected applica…
CVE-2025-46736Medium5.32025-05-06Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API re…
CVE-2025-24342Medium5.32025-04-30A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernames via multiple cr…
CVE-2025-30150Medium5.32025-04-08Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail ad…
CVE-2025-30280Medium5.32025-04-08A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendix Runtime V10.18 (A…
CVE-2024-56476Medium5.32025-04-02IBM TXSeries for Multiplatforms 9.1 and 11.1 could allow an attacker to enumerate usernames due to an observable login attempt response discrepancy.
CVE-2025-31124Medium5.32025-03-31Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate a…
CVE-2025-29102025-03-28User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an emai…