CWE-204.

Vantage6: Set admin user and password from environment or configuration

• CWE-204
• CWE-1393

<5.0.0 · fixed in 5.0.0

FOSSBilling's password reset confirmation endpoint lacks rate limiting

• FOSSBilling
• Authentication bypass
• CWE-204

FreeScout: User Account Enumeration via Password Reset Response Differentiation

• freescout
• Information disclosure
• CWE-204

userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

• userSpice
• CWE-204

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

• Broken access control
• CWE-204

<=29.0 · no fixed version yet

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

• WSO2 Identity Server
• WSO2 Open Banking IAM
• CWE-204

Industrial Application Software IAS Canias ERP Login RMI doAction response discrepancy

• Industrial Application Software IAS Canias ERP
• Information disclosure
• CWE-204

Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users

• CWE-204

<=0.19.1-rc.1 · no fixed version yet

Statamic CMS vulnerable to email enumeration via forgot password endpoint

• CWE-204

<5.73.21 || >=6.0.0, <6.15.0 · fixed in 5.73.21, 6.15.0

Cisco Identity Services Engine Observable Response Discrepancy Vulnerability

• Cisco Identity Services Engine Software
• CWE-204

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client).

• Oracle Corporation MySQL Shell
• CWE-204

OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API

• openaev
• CWE-204

ChurchCRM: Username Enumeration via Differential Response in Public Login API

• CRM
• Authentication bypass
• CWE-204

Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA

• SAP_SE SAP Human Capital Management for SAP S/4HANA
• CWE-204

SonicWall SMA1000: An observable response discrepancy vulnerability in the SonicWall SMA1000 series…

• SonicWall SMA1000
• CWE-204

Saleor has a user enumeration vulnerability due to different error messages

• saleor
• CWE-204

The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000.

• CWE-204

The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000.

• CWE-204

User enumeration in ESET Protect (on-prem)

• ESET, spol. s.r.o ESET Protect (on-prem)
• CWE-204

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

• CWE-204

<=26.0 · no fixed version yet

MinIO LDAP login brute-force via user enumeration and missing rate limit

• Authentication bypass
• CWE-204

<=0.0.0-20260212201848-7aac2a2c5b7c · no fixed version yet

Parse Server email verification resend page leaks user existence

• CWE-204

<8.6.51 || >=9.0.0, <9.6.0-alpha.40 · fixed in 8.6.51, 9.6.0-alpha.40

Chamilo LMS: User enumeration vulnerability via response

• chamilo-lms
• CWE-204

User enumeration in Raytha CMS

• Raytha
• CWE-204

IBM Aspera Console Information Disclosure

• IBM Aspera Console
• CWE-204

Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica.

• OpenText™ Vertica
• CWE-204

Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint

• Checkmk
• CWE-204

Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint

• Checkmk
• CWE-204

projectsend Auth.php response discrepancy

• projectsend
• Information disclosure
• CWE-204

Shopware has user enumeration via distinct error codes on Store API login endpoint

• CWE-204

<6.6.10.15 || >=6.7.0.0, <6.7.8.1 · fixed in 6.6.10.15, 6.7.8.1

Parse Server vulnerable to user enumeration via email verification endpoint

• CWE-204

<8.6.34 || >=9.0.0-alpha.1, <9.6.0-alpha.8 · fixed in 8.6.34, 9.6.0-alpha.8

NocoDB Vulnerable to User Enumeration via Password Reset Endpoint

• CWE-204

<0.301.3 · fixed in 0.301.3

Dify has a user enumeration issue

• langgenius dify
• CWE-204

Rucio WebUI has Username Enumeration via Login Error Message

• CWE-204

<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1 · fixed in 35.8.3, 38.5.4, 39.3.1

Piwigo Vulnerable to User Enumeration via Password Reset Endpoint

• Piwigo
• CWE-204

Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames

• CWE-204

>=2.1.0, <2.41.0 · fixed in 2.41.0

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint.

• CWE-204

DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different username...

• CWE-204

· no fixed version yet

Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies

• gunet openeclass
• CWE-204

CI4MS Vulnerable to User Email Enumeration via Password Reset Flow

• Information disclosure
• CWE-204

<0.28.5.0 · fixed in 0.28.5.0

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user i…

• Discord WebSocket API service
• CWE-204

Zitadel has a user enumeration vulnerability in Login UIs

• Information disclosure
• CWE-204

<3.4.6 || >=4.0.0, <4.9.1 · fixed in 3.4.6, 4.9.1

Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists in code.gitea.io/gitea

• CWE-204

<1.25.2 · fixed in 1.25.2

AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery

• Mintplex-Labs anything-llm
• Information disclosure
• CWE-204

ChurchCRM has plaintext password return in response

• CRM
• CWE-204

Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated us…

• Pegasystems Pega Infinity
• CWE-204

Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration

• mastodon
• CWE-204

IntelliChoice eFORCE Software Suite Username Enumeration

• IntelliChoice eFORCE Software Suite
• CWE-204

A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1).

• Siemens Gridscale X Prepay
• CWE-204

Medtronic CareLink Network: Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a…

• Medtronic CareLink Network
• CWE-204

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism.

• CWE-204

Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure

• CWE-204

<1.8.0-beta.27 · fixed in 1.8.0-beta.27

User enumeration in Windu CMS

• JCD Windu CMS
• CWE-204

Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability.

• Omnissa Workspace ONE UEM
• CWE-204

Frontier Airlines publicly available email address validation

• Frontier Airlines flyfrontier.com
• CWE-204

Tibbo AggreGate Network Manager < 6.40.05 Login Functionality User Enumeration

• Tibbo Systems AggreGate Network Manager
• CWE-204

D-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account Enumeration

• D-Link Nuclias Connect
• CWE-204

D-Link Nuclias Connect <= v1.3.1.4 Login Account Enumeration

• D-Link Nuclias Connect
• CWE-204

Icinga 2 API users could access restricted values in filter expressions

• icinga2
• Information disclosure
• CWE-204

Icinga DB Web hidden/protected custom variables are prone to filter enumeration

• icingadb-web
• CWE-204