CWE-204
AllowedObservable Response Discrepancy
Abstraction: Base · Status: Incomplete
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
297 vulnerabilities reference this CWE, most recent first.
GHSA-7W82-8H79-M4WP
Vulnerability from github – Published: 2024-06-17 18:31 – Updated: 2024-11-18 16:26A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulation of the argument Email leads to observable response discrepancy. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-6056"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T18:15:18Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulation of the argument Email leads to observable response discrepancy. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-7w82-8h79-m4wp",
"modified": "2024-11-18T16:26:44Z",
"published": "2024-06-17T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6056"
},
{
"type": "WEB",
"url": "https://powerful-bulb-c36.notion.site/idor-c6eb58e8fc40416ba53c7915ca0174c4?pvs=4"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.268784"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.268784"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.352978"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-875X-G8P7-5W27
Vulnerability from github – Published: 2024-07-15 16:37 – Updated: 2024-07-15 21:38Summary
The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found.
Details
When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the allowedCredentials property in the assertion options response. This allows enumeration of valid or invalid usernames.
Proposal how to resolve it:
return $this->publicKeyCredentialRequestOptionsFactory->create(
$this->profile,
count($allowedCredentials) <= 0 ? self::getRandomCredentials(): $allowedCredentials,
$optionsRequest->userVerification,
$extensions
);
private static function getRandomCredentials(): array
{
$credentialSources = [];
for ($i = 0; $i <= rand(0,1); $i++) {
$credentialSources[] = new PublicKeyCredentialSource(
random_bytes(32),
"public-key",
[],
"basic",
new EmptyTrustPath(),
Uuid::v7(),
random_bytes(77),
Uuid::v7()->__toString(),
rand(0, 6000),
null
);
}
return array_map(
static fn (PublicKeyCredentialSource $credential): PublicKeyCredentialDescriptor => $credential->getPublicKeyCredentialDescriptor(),
$credentialSources
);
}
PoC
curl https://example.com/assertion/options \ -H 'content-type: application/json' \ --data-raw '{"username":"NotMeRandomUsername123"}'
Impact
By knowing which usernames are valid, attackers can focus their efforts on a smaller set of potential targets, increasing the efficiency and likelihood of successful attacks.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "web-auth/webauthn-lib"
},
"ranges": [
{
"events": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.9.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "web-auth/webauthn-framework"
},
"ranges": [
{
"events": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39912"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-15T16:37:49Z",
"nvd_published_at": "2024-07-15T20:15:03Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nThe ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found.\n\n### Details\n\nWhen WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the `allowedCredentials` property in the assertion options response. This allows enumeration of valid or invalid usernames.\n\n#### Proposal how to resolve it:\n \n```\nreturn $this-\u003epublicKeyCredentialRequestOptionsFactory-\u003ecreate(\n $this-\u003eprofile,\n count($allowedCredentials) \u003c= 0 ? self::getRandomCredentials(): $allowedCredentials,\n $optionsRequest-\u003euserVerification,\n $extensions\n);\n\nprivate static function getRandomCredentials(): array\n{\n $credentialSources = [];\n for ($i = 0; $i \u003c= rand(0,1); $i++) {\n $credentialSources[] = new PublicKeyCredentialSource(\n random_bytes(32),\n \"public-key\",\n [],\n \"basic\",\n new EmptyTrustPath(),\n Uuid::v7(),\n random_bytes(77),\n Uuid::v7()-\u003e__toString(),\n rand(0, 6000),\n null\n );\n }\n return array_map(\n static fn (PublicKeyCredentialSource $credential): PublicKeyCredentialDescriptor =\u003e $credential-\u003egetPublicKeyCredentialDescriptor(),\n $credentialSources\n );\n}\n```\n\n### PoC\n\ncurl https://example.com/assertion/options \\\n -H \u0027content-type: application/json\u0027 \\\n --data-raw \u0027{\"username\":\"NotMeRandomUsername123\"}\u0027\n\n### Impact\n\nBy knowing which usernames are valid, attackers can focus their efforts on a smaller set of potential targets, increasing the efficiency and likelihood of successful attacks.\n",
"id": "GHSA-875x-g8p7-5w27",
"modified": "2024-07-15T21:38:21Z",
"published": "2024-07-15T16:37:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-875x-g8p7-5w27"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39912"
},
{
"type": "WEB",
"url": "https://github.com/web-auth/webauthn-framework/commit/64de11f6cddc71e56c76e0cc4573bf94d02be045"
},
{
"type": "WEB",
"url": "https://github.com/web-auth/webauthn-framework/commit/a9d1352897fba552e659e1445a771dec2d4ed05a"
},
{
"type": "WEB",
"url": "https://github.com/web-auth/webauthn-lib/commit/b6798de27cdedd8681fe4c9b13ace0ff2456d18b"
},
{
"type": "PACKAGE",
"url": "https://github.com/web-auth/webauthn-framework"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames "
}
GHSA-8QH8-5VX6-PV8R
Vulnerability from github – Published: 2024-07-10 18:32 – Updated: 2024-07-10 18:32IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697.
{
"affected": [],
"aliases": [
"CVE-2023-33859"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-10T16:15:02Z",
"severity": "MODERATE"
},
"details": "IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697.",
"id": "GHSA-8qh8-5vx6-pv8r",
"modified": "2024-07-10T18:32:17Z",
"published": "2024-07-10T18:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33859"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/257697"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7159770"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8RCR-H4V8-QPQ5
Vulnerability from github – Published: 2025-01-24 00:31 – Updated: 2025-01-24 00:31Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
{
"affected": [],
"aliases": [
"CVE-2025-0693"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-23T22:15:15Z",
"severity": "MODERATE"
},
"details": "Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.",
"id": "GHSA-8rcr-h4v8-qpq5",
"modified": "2025-01-24T00:31:47Z",
"published": "2025-01-24T00:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0693"
},
{
"type": "WEB",
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8VFF-35QM-QJVV
Vulnerability from github – Published: 2024-09-18 22:10 – Updated: 2024-09-19 21:48Summary
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.
However when an incorrect username is provided along side with weak password, the application responds with ’Invalid credentials’ notification.
This difference could be used to perform username enumeration.
Patches
Update to 5.1.1 or later.
If you have any questions or comments about this advisory:
Email us at security@mautic.org
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "mautic/core"
},
"ranges": [
{
"events": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-47059"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-204"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-18T22:10:05Z",
"nvd_published_at": "2024-09-18T22:15:04Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nWhen logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.\n\nHowever when an incorrect username is provided along side with weak password, the application responds with \u2019Invalid credentials\u2019 notification.\n\nThis difference could be used to perform username enumeration.\n\n### Patches\n\nUpdate to 5.1.1 or later.\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@mautic.org](mailto:security@mautic.org)",
"id": "GHSA-8vff-35qm-qjvv",
"modified": "2024-09-19T21:48:35Z",
"published": "2024-09-18T22:10:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mautic/mautic/security/advisories/GHSA-8vff-35qm-qjvv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47059"
},
{
"type": "PACKAGE",
"url": "https://github.com/mautic/mautic"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Mautic allows users enumeration due to weak password login"
}
GHSA-8W88-46CP-7C4J
Vulnerability from github – Published: 2025-12-04 21:31 – Updated: 2025-12-04 21:31Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.
{
"affected": [],
"aliases": [
"CVE-2025-12994"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-04T20:16:17Z",
"severity": "MODERATE"
},
"details": "Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.",
"id": "GHSA-8w88-46cp-7c4j",
"modified": "2025-12-04T21:31:04Z",
"published": "2025-12-04T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12994"
},
{
"type": "WEB",
"url": "https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-922M-Q3X3-5PF9
Vulnerability from github – Published: 2026-03-30 09:31 – Updated: 2026-03-30 09:31User enumeration in ESET Protect (on-prem) via Response Timing.
{
"affected": [],
"aliases": [
"CVE-2025-3716"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-30T08:16:16Z",
"severity": "MODERATE"
},
"details": "User enumeration in ESET Protect (on-prem) via\u00a0Response Timing.",
"id": "GHSA-922m-q3x3-5pf9",
"modified": "2026-03-30T09:31:28Z",
"published": "2026-03-30T09:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3716"
},
{
"type": "WEB",
"url": "https://help.eset.com/changelogs/?product=protect\u0026lang=en-US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-93CV-HRV4-P8Q4
Vulnerability from github – Published: 2024-06-15 15:30 – Updated: 2024-06-15 15:30IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in further attacks. IBM X-Force ID: 287174.
{
"affected": [],
"aliases": [
"CVE-2024-31870"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-15T14:15:09Z",
"severity": "LOW"
},
"details": "IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in further attacks. IBM X-Force ID: 287174.",
"id": "GHSA-93cv-hrv4-p8q4",
"modified": "2024-06-15T15:30:27Z",
"published": "2024-06-15T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31870"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/287174"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7157638"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-95JR-RM62-VH35
Vulnerability from github – Published: 2026-04-01 18:36 – Updated: 2026-04-01 21:30The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behaviour in newer versions.
{
"affected": [],
"aliases": [
"CVE-2025-67807"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-01T16:23:48Z",
"severity": "MODERATE"
},
"details": "The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behaviour in newer versions.",
"id": "GHSA-95jr-rm62-vh35",
"modified": "2026-04-01T21:30:29Z",
"published": "2026-04-01T18:36:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67807"
},
{
"type": "WEB",
"url": "https://pastebin.com/Tk4LgMG2"
},
{
"type": "WEB",
"url": "https://www.sagedpw.at"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-984H-8PHV-MF43
Vulnerability from github – Published: 2026-01-22 09:31 – Updated: 2026-01-22 09:31Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "offline"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as "You will appear offline."
{
"affected": [],
"aliases": [
"CVE-2026-24332"
],
"database_specific": {
"cwe_ids": [
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-22T08:16:00Z",
"severity": "MODERATE"
},
"details": "Discord through 2026-01-16 allows gathering information about whether a user\u0027s client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with \"status\": \"offline\"), whereas offline users are omitted from the presences array. This is arguably inconsistent with the UI description of Invisible as \"You will appear offline.\"",
"id": "GHSA-984h-8phv-mf43",
"modified": "2026-01-22T09:31:39Z",
"published": "2026-01-22T09:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24332"
},
{
"type": "WEB",
"url": "https://xmrcat.org/discord-invisibility-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-331: ICMP IP Total Length Field Probe
An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.
CAPEC-332: ICMP IP 'ID' Field Error Message Probe
An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.
CAPEC-541: Application Fingerprinting
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.
CAPEC-580: System Footprinting
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.