NIST 800-53 r5 · Controls catalogue · Family IA
IA-6Authentication Feedback
Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.
Last updated: 21 August 2026 20:21 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (8)
- T1021.001 Remote Desktop Protocol Lateral Movement
- T1021.005 VNC Lateral Movement
- T1530 Data from Cloud Storage Collection
- T1563 Remote Service Session Hijacking Lateral Movement
- T1578 Modify Cloud Compute Infrastructure Defense Impairment
- T1578.001 Create Snapshot Defense Impairment
- T1578.002 Create Cloud Instance Defense Impairment
- T1578.003 Delete Cloud Instance Defense Impairment
Weaknesses this control addresses (3)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 11,000+ | Obscuring authentication feedback prevents exposure of sensitive information such as valid usernames or failure reasons to unauthorized actors. |
CWE-209 | Generation of Error Message Containing Sensitive Information | 600+ | The control directly mitigates generation of error messages containing sensitive authentication details by requiring obscured feedback instead of verbose responses. |
CWE-549 | Missing Password Field Masking | 16 | Obscuring feedback includes masking password input (e.g., asterisks), which addresses the weakness of missing password field masking. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-23771 UPD | 7.5 | 9.8 | 0.0106 | good |
CVE-2024-25189 UPD | 7.5 | 9.8 | 0.0095 | good |
CVE-2024-25190 UPD | 7.5 | 9.8 | 0.0090 | good |
CVE-2024-25191 UPD | 7.5 | 9.8 | 0.0089 | good |
CVE-2024-39891 KEV UPD | 7.5 | 5.3 | 0.0167 | good |
CVE-2024-25714 UPD | 7.4 | 9.8 | 0.0081 | good |
CVE-2025-27667 UPD | 7.4 | 9.8 | 0.0064 | good |
CVE-2025-39702 UPD | 7.3 | 9.8 | 0.0042 | good |
CVE-2026-23519 UPD | 7.3 | 9.8 | 0.0052 | good |
CVE-2019-25337 UPD | 7.3 | 9.8 | 0.0041 | good |
CVE-2018-25350 UPD | 7.3 | 9.8 | 0.0043 | good |
CVE-2024-47678 UPD | 7.1 | 9.4 | 0.0061 | good |
CVE-2025-14816 UPD | 7.0 | 9.3 | 0.0010 | partial |
CVE-2025-10890 | 6.8 | 9.1 | 0.0029 | good |
CVE-2026-15747 | 6.7 | 9.1 | 0.0026 | good |
CVE-2026-74961 | 6.7 | 9.1 | 0.0025 | good |
CVE-2025-5485 UPD | 6.5 | 8.6 | 0.0041 | good |
CVE-2026-41588 UPD | 6.3 | 9.0 | 0.0036 | good |
CVE-2026-69519 | 6.3 | 8.6 | 0.0058 | good |
CVE-2024-0553 UPD | 6.2 | 7.5 | 0.0161 | good |
CVE-2023-6258 UPD | 6.2 | 8.1 | 0.0056 | good |
CVE-2024-54767 UPD | 6.2 | 7.5 | 0.0182 | good |
CVE-2023-50781 UPD | 6.1 | 7.5 | 0.0112 | good |
CVE-2023-50782 UPD | 6.1 | 7.5 | 0.0112 | good |
CVE-2024-5124 UPD | 6.1 | 7.5 | 0.0141 | good |