CWE · MITRE source
CWE-656Reliance on Security Through Obscurity
The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
This reliance on "security through obscurity" can produce resultant weaknesses if an attacker is able to reverse engineer the inner workings of the mechanism. Note that obscurity can be one small part of defense in depth, since it can create more work for an attacker; however, it is a significant risk if used as the primary means of protection.
Last updated: 14 October 2026 20:41 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A06:2025 Insecure Design.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-10284 UPD | 7.1 | 9.1 | 0.0139 | 2020-07-15 |
CVE-2020-10286 UPD | 6.7 | 8.8 | 0.0074 | 2020-07-15 |
CVE-2026-42363 UPD | 6.5 | 9.3 | 0.0031 | 2026-04-27 |
CVE-2026-7161 UPD | 6.5 | 9.3 | 0.0036 | 2026-05-04 |
CVE-2024-9138 UPD | 5.7 | 7.2 | 0.0115 | 2025-01-03 |
CVE-2020-10277 UPD | 4.9 | 6.4 | 0.0037 | 2020-06-24 |
CVE-2024-5244 UPD | 3.5 | 4.2 | 0.0038 | 2024-05-23 |
CVE-2025-25983 UPD | 2.9 | 3.4 | 0.0031 | 2025-04-18 |