An oracle vulnerability exists when a system leaks useful information through differences in responses, error messages, or timing. Even if the system does not directly expose a secret, an attacker can make repeated requests and use those small clues to infer whether a guessed value, key, token, or ciphertext is valid.
This matters because side channels can turn a hardened feature into a probe. In practice, attackers use oracle behavior to recover protected data, test padding or metadata validity, or narrow the search space for encryption keys and signed values. Defenders look for uniform responses, constant-time checks, generic errors, and rate limits, and they remove distinctions that let an attacker tell success from failure. In web applications, oracle flaws often appear in upload handlers, authentication checks, and cryptographic validation paths.