CWE-204 - Observable Response Discrepancy

Weakness Name

Observable Response Discrepancy

Description

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

This issue frequently occurs during authentication, where a difference in failed-login messages could allow an attacker to determine if the username is valid or not. These exposures can be inadvertent (bug) or intentional (design).

Common Consequences

Related Weaknesses

CWE-203Observable Discrepancy