CWE-204 Observable Response Discrepancy

Contao: The registration module re-sends activation mails

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Filament: Password validity disclosure for accounts denied panel access on login page

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Budibase: Account Enumeration via Login Lockout Response Differential

Ghost: Member existence leak via magic link sign-in response

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Vantage6: Set admin user and password from environment or configuration

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

vantage6 vulnerable to Observable Response Discrepancy

Statamic CMS vulnerable to email enumeration via forgot password endpoint

Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users

Parse Server email verification resend page leaks user existence

MinIO LDAP login brute-force via user enumeration and missing rate limit

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

Parse Server vulnerable to user enumeration via email verification endpoint

Shopware has user enumeration via distinct error codes on Store API login endpoint

NocoDB Vulnerable to User Enumeration via Password Reset Endpoint

Rucio WebUI has Username Enumeration via Login Error Message

Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames

CI4MS Vulnerable to User Email Enumeration via Password Reset Flow

Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms

Zitadel has a user enumeration vulnerability in Login UIs