Rule Definition
When the product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, security-relevant information about the state of the product can be exposed such as whether a particular operation was successful or not.

Remediation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else.

Violation Code Sample

username = input("Enter your username:")
password = input("Enter your password:")

if valid_username(username):
    if valid_password(username, password):
        print("Login Succesful")
    else:
        print("Login Failed - incorrect password")
else:
    print("Login Failed - unknown username")

Fixed Code Sample

username = input("Enter your username:")
password = input("Enter your password:")

if valid_password(username, password):
    print("Login Succesful")
else:
    print("Login Failed - incorrect username or password")

CWE-204: Observable Response Discrepancy https://cwe.mitre.org/data/definitions/204.html