The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

What CVEs are caused by CWE-204?

169 recorded CVEs are attributed to CWE-204, including CVE-2018-25350, CVE-2026-60007, CVE-2026-15747.

What are the consequences of CWE-204?

Exploiting CWE-204 can lead to: Read Application Data, Bypass Protection Mechanism.

Is CWE-204 actively exploited?

169 recorded CVEs are caused by CWE-204; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-204: Observable Response Discrepancy

Overview

CWE-204 (Observable Response Discrepancy) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

169 recorded CVEs are caused by CWE-204 (Observable Response Discrepancy). The highest-severity and most recent are shown first. 60 new CWE-204 CVEs have been recorded so far in 2026 (51 in 2025).

CVE-2018-25350
userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php
Critical · CVSS 9.3 · EPSS 36th
2026-05-23
CVE-2026-60007
Critical · CVSS 9.1 · EPSS 31th
2026-08-04
CVE-2026-15747
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
Critical · CVSS 9.1 · EPSS 17th
2026-07-14
CVE-2025-5485
SinoTrack GPS Receiver Weak Authentication
High · CVSS 8.8 · EPSS 34th
2025-06-12
CVE-2026-69519
Azure Stack HCI Information Disclosure Vulnerability
High · CVSS 8.6 · EPSS 45th
2026-08-20
CVE-2026-27462
Combodo iTop: User enumeration via password reset
High · CVSS 7.5 · EPSS 24th
2026-08-21
CVE-2025-46390
High · CVSS 7.5 · EPSS 24th
2025-08-06
CVE-2025-3092
MB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT24
High · CVSS 7.5 · EPSS 34th
2025-06-24
CVE-2025-23193
Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP
High · CVSS 7.5 · EPSS 27th
2025-02-11
CVE-2024-42343
High · CVSS 7.5 · EPSS 26th
2024-09-08
CVE-2024-38431
High · CVSS 7.5 · EPSS 28th
2024-07-30
CVE-2024-38322
High · CVSS 7.5 · EPSS 34th
2024-06-28

Showing 12 of 169 recorded CWE-204 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-204 vulnerabilities

Common consequences

What can happen when CWE-204 is exploited.

Read Application Data, Bypass Protection Mechanism

Affects: Confidentiality, Access Control

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

How to prevent it

Practical mitigations for CWE-204, grouped by where in the lifecycle they apply.

Architecture and Design

Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Implementation

Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.

If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.

Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.

Vulnerable example

perl

my $username=param('username');

Resulting query

plaintext

"Login Failed - incorrect username or password"

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2002-2094 — This, and others, use ".." attacks and monitor error responses, so there is overlap with directory traversal.
CVE-2001-1483 — Enumeration of valid usernames based on inconsistent responses
CVE-2001-1528 — Account number enumeration via inconsistent responses.
CVE-2004-2150 — User enumeration via discrepancies in error messages.
CVE-2005-1650 — User enumeration via discrepancies in error messages.
CVE-2004-0294 — Bulletin Board displays different error messages when a user exists or not, which makes it easier for remote attackers to identify valid users and conduct a brute force password guessing attack.
CVE-2004-0243 — Operating System, when direct remote login is disabled, displays a different message if the password is correct, which allows remote attackers to guess the password via brute force methods.
CVE-2002-0514 — Product allows remote attackers to determine if a port is being filtered because the response packet TTL is different than the default TTL.
CVE-2002-0515 — Product sets a different TTL when a port is being filtered than when it is not being filtered, which allows remote attackers to identify filtered ports by comparing TTLs.
CVE-2001-1387 — Product may generate different responses than specified by the administrator, possibly leading to an information leak.
CVE-2004-0778 — Version control system allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned.
CVE-2004-1428 — FTP server generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames.

How this weakness relates to others in the CWE hierarchy.

Parent

CWE-203: Observable Discrepancy

Terminology & mappings

Mapped taxonomies

PLOVER: Response discrepancy infoleak

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-204.

What is CWE-204?: The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
What CVEs are caused by CWE-204?: 169 recorded CVEs are attributed to CWE-204, including CVE-2018-25350, CVE-2026-60007, CVE-2026-15747.
How do you prevent CWE-204?: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
What are the consequences of CWE-204?: Exploiting CWE-204 can lead to: Read Application Data, Bypass Protection Mechanism.
Is CWE-204 actively exploited?: 169 recorded CVEs are caused by CWE-204; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.