CWE-206
Observable Internal Behavioral Discrepancy
The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.
Impactr finds and proves whether CWE-206 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.