Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.
Combodo iTop versions prior to 3.2.3 have a vulnerability in the password reset mechanism that allows user enumeration through observable differences in responses to valid versus invalid usernames. This issue has been addressed and fixed in version 3.2.3.
CVE-2026-69519 is a high-severity vulnerability in Microsoft Azure Stack HCI involving an observable response discrepancy. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 8.6, indicating significant impact on confidentiality. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service.
CVE-2026-66002 is a vulnerability in the Frappe web application framework where the public request-data web form and PersonalDataDownloadRequest class leak information by returning different response shapes for registered versus unregistered email addresses. This allows remote attackers to enumerate registered users by comparing responses. The issue is fixed in versions 15.115.0 and 16.27.0.
CVE-2026-54739 is a vulnerability in LemmyNet's lemmy software where the login endpoint reveals whether a username or email exists by returning different error responses. This discrepancy allows unauthenticated attackers to enumerate valid accounts, facilitating targeted credential attacks or social engineering. The issue affects versions prior to 0.19.19 and versions from 1.0.0-alpha.0 up to but excluding 1.0.0-beta.1. It is fixed in versions 0.19.19 and 1.0.0-beta.1.
CVE-2026-72588 is a user enumeration vulnerability in bluewave-labs Checkmate up to version 2.1.0. It allows unauthenticated remote attackers to determine if an email address is registered by observing different HTTP response codes from the password recovery endpoint. This discrepancy enables attackers to enumerate valid user accounts. The vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-55998 is a medium severity vulnerability in SUSE Rancher versions 2.11.0, 2.12.0, 2.13.0, and 2.14.0. The issue arises from an endpoint that retrieves cluster objects before validating tokens, causing different HTTP responses based on the existence of cluster IDs and their configuration. This discrepancy allows attackers to reliably enumerate valid cluster IDs.
CVE-2026-60007 is a critical vulnerability in Eclipse Milo versions 0.6.0 through 1.1.4 where username-token processing leaks distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This flaw allows an on-path attacker to exploit repeated unauthenticated ActivateSession requests as a padding oracle to recover a victim's password and authenticate using the recovered credentials.
CVE-2026-14202 is an observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc.'s HUMANIST Digital Human Resources product. This vulnerability allows an attacker to perform account footprinting by observing differences in responses. It affects version 26.0 of the product prior to 26.1. The CVSS 3.1 base score is 5.3, indicating a medium severity. No official patch or remediation guidance has been provided yet.
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. This issue has been fixed in version 0.10.6.1.
HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system. Use renumeration is when a malicious actor can use brute-force techniques to either guess or confirm valid users in a system
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.
_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.
An attacker able to query it can recover the token and pass csrf_protect validation.
SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory.
The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to bypass the is_within_root/2 check without being resolved. The un-canonicalized path then enters resolve_symlinks/2, which walks up the directory tree above the configured root and issues read_link() syscalls on arbitrary filesystem paths.
An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path. The server response differs depending on whether the target path exists on the host filesystem (SSH_FXP_NAME when the path resolves successfully, SSH_FX_NO_SUCH_FILE when it does not). This creates a path-existence oracle that an attacker can use to enumerate the filesystem structure outside the configured root, including the existence of sensitive files, directories, and mount points.
The vulnerability leaks only the existence of paths. No file contents, credentials, or write access are obtainable through this issue alone. The information gained may assist further attacks when combined with other vulnerabilities.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routine ssh_sftpd:handle_op/4.
This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssh from 3.0.1 before 6.0.2, 5.5.2.2 and 5.2.11.9.
MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differences to enumerate valid usernames and email addresses.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.