cve.bz

CWE-522: Insufficiently Protected Credentials, page 5

Filter

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

What the weakness is: CWE-522 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 13
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-474 Signature Spoofing by Key Theft Likelihood: Medium · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-551 Modify Existing Service
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-522, as MITRE names them. Credits.

Ask an AI about CWE-522

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-522: Insufficiently Protected Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/522.html and https://cve.bz/cve/cwe/522?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.8CVE-2026-55885EPSS 0.2%

    Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator pas…

  2. 7.1CVE-2026-59209EPSS 0.4%

    n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object in…

  3. 4.9CVE-2026-11827EPSS 0.4%

    GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions …

  4. 8.4CVE-2026-59261EPSS 0.3%

    OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials th…

  5. 9.9CVE-2026-56843EPSS 0.7%

    Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema valida…

  6. 6.1CVE-2026-55431EPSS 0.3%

    Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` opens external workspace-app URLs without validating the scheme or host. When an …

  7. 7.1CVE-2026-7017EPSS 0.3%

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the ca…

  8. 8.8CVE-2026-44938EPSS 0.4%

    A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespa…

  9. 4.8CVE-2026-1433EPSS 0.3%

    uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface (RUI). Expl…

  10. 9.8CVE-2026-9079EPSS 1.1%

    libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

  11. 9.1CVE-2026-8926EPSS 0.4%

    When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in…

  12. 6.5CVE-2026-14019EPSS 0.3%

    Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  13. 7.1CVE-2026-56783EPSS 0.3%

    Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any aut…

  14. 6.8CVE-2025-7386EPSS 0.4%

    Information exposure vulnerability in Hitachi Storage Navigator. This issue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8: before DKCMAIN Ver. 90-09-24-00/00, SVP Ver. 90-09-24/00, before…

  15. 8.2CVE-2026-55188EPSS 0.3%

    RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replica…

  16. 5.5CVE-2026-45407EPSS 0.1%

    Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission set…

  17. 6.9CVE-2026-44622EPSS 0.4%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  18. 6.5CVE-2026-55180EPSS 0.4%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious re…

  19. 6.9CVE-2026-50017EPSS 0.4%

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a defau…

  20. 8.7CVE-2026-9650EPSS 0.4%

    CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this cred…

  21. 5.5CVE-2026-32315EPSS 1.7%

    motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions (-rw-r--r--), making it…

  22. 6.3CVE-2026-54276EPSS 0.3%

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulner…

  23. 5.5CVE-2026-53632EPSS 0.4%

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attemp…

  24. 6.0CVE-2026-53840EPSS 0.2%

    OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint…

  25. 7.7CVE-2026-6517EPSS 0.2%

    Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to interc…

  26. 6.0CVE-2026-49949EPSS 0.3%

    CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport.…

  27. 4.4CVE-2024-45636EPSS 0.09%

    IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user.

  28. 6.1CVE-2026-41715EPSS 0.2%

    In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects…

  29. 7.1CVE-2026-39908ExploitEPSS 0.8%

    OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the process user by configuring a job proxy source with a UNC path pointing to an attack…

  30. 9.1CVE-2026-46440EPSS 0.2%

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue ha…

  31. 8.7CVE-2026-46511EPSS 0.3%

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated at…

  32. 4.9CVE-2026-7313EPSS 0.3%

    CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Suc…

  33. 7.5CVE-2026-7312EPSS 0.4%

    CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600…

  34. 2.0CVE-2026-4387EPSS 0.1%

    StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users…

  35. 6.5CVE-2026-49379EPSS 0.3%

    In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

  36. 5.9CVE-2026-42951EPSS 0.2%

    An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.

  37. 4.9CVE-2024-47271EPSS 0.3%

    Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information vi…

  38. 4.3CVE-2026-2255EPSS 0.2%

    Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those exp…

  39. 2.0CVE-2026-9395EPSS 0.2%

    A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation leads to insufficiently protected credentials. The attack needs to be initiated wit…

  40. 7.1CVE-2026-39968EPSS 0.3%

    TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Authorization Bypass") is incomplete. While the builder's getCredentials tRPC endp…

  41. 7.1CVE-2025-13477EPSS 0.2%

    Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass. This issue affects WifiBurada: through 2105…

  42. 6.9CVE-2026-0393EPSS 0.2%

    The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within…

  43. 6.5CVE-2026-6345EPSS 0.2%

    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Adviso…

  44. 3.0CVE-2025-62312EPSS 0.1%

    HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential interception or misuse, especially if not combined with secure …

  45. 5.9CVE-2026-6253EPSS 0.7%

    curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs…

  46. 9.8CVE-2026-43992EPSS 0.2%

    JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit too…

  47. 6.5CVE-2026-8368EPSS 0.3%

    LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-su…

  48. 9.1CVE-2026-45091EPSS 0.3%

    sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload …

  49. 4.6CVE-2026-28961EPSS 0.2%

    This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. An attacker with physical access to a locked device may be able to view sensitive user information.

  50. 10.0CVE-2026-42869EPSS 0.6%

    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships…