cve.bz

CWE-522: Insufficiently Protected Credentials, page 6

Filter

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

What the weakness is: CWE-522 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 13
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-474 Signature Spoofing by Key Theft Likelihood: Medium · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-551 Modify Existing Service
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-522, as MITRE names them. Credits.

Ask an AI about CWE-522

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-522: Insufficiently Protected Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/522.html and https://cve.bz/cve/cwe/522?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.5CVE-2026-42295EPSS 0.4%

    Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, se…

  2. 7.4CVE-2026-41506EPSS 0.3%

    go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This …

  3. 7.5CVE-2025-31976EPSS 0.2%

    HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated…

  4. 2.7CVE-2025-62345EPSS 0.2%

    HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input handling implementation, increasing the risk of misconfiguration and operational…

  5. 5.1CVE-2026-23927EPSS 0.2%

    A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a n…

  6. 6.5CVE-2026-42367EPSS 0.3%

    A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to credentials leak. An attacker can visit a webpage to trigger this vuln…

  7. 5.4CVE-2026-6446EPSS 0.2%

    The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of autho…

  8. 6.5CVE-2026-28909EPSS 0.2%

    Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.

  9. 7.1CVE-2026-35155EPSS 0.2%

    Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain elevated access.

  10. 1.9CVE-2026-7038EPSS 0.1%

    A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is r…

  11. 9.3CVE-2026-39462EPSS 0.4%

    A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the S…

  12. 6.0CVE-2026-41345EPSS 0.3%

    OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirec…

  13. 7.7CVE-2026-41266EPSS 4.1%

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration w…

  14. 2.7CVE-2026-6408EPSS 0.2%

    Tanium addressed an information disclosure vulnerability in Tanium Server.

  15. 7.8CVE-2025-36568EPSS 0.1%

    Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently protected cr…

  16. 6.2CVE-2025-15622EPSS 0.2%

    Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an ac…

  17. 5.7CVE-2025-15621EPSS 0.1%

    Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

  18. 9.4CVE-2026-40173EPSS 0.5%

    Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without …

  19. 8.8CVE-2026-32171EPSS 0.4%

    Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

  20. 2.7CVE-2026-27316EPSS 0.3%

    A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentia…

  21. 6.5CVE-2026-22576EPSS 0.3%

    A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 thro…

  22. 6.5CVE-2026-22574EPSS 0.3%

    A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 thro…

  23. 4.3CVE-2026-34262EPSS 0.3%

    Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

  24. 8.7CVE-2026-35185EPSS 0.4%

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client …

  25. 7.5CVE-2026-35467EPSS 0.2%

    The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

  26. 6.5CVE-2026-4819EPSS 0.2%

    In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

  27. 8.2CVE-2026-29872EPSS 0.3%

    A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in p…

  28. 8.6CVE-2026-33575EPSS 0.3%

    OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots…

  29. 8.3CVE-2025-15617EPSS 0.4%

    Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to per…

  30. 8.4CVE-2025-13478EPSS 0.3%

    Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via insecure application cache handling. This issue affects Identity Manager: 25.2(…

  31. 6.6CVE-2026-33182EPSS 0.4%

    Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absol…

  32. 5.5CVE-2025-36440EPSS 0.2%

    IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control.

  33. 6.5CVE-2025-14790EPSS 0.2%

    IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information due to insufficiently protected credentials.

  34. 7.3CVE-2025-64998EPSS 0.3%

    Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies.

  35. 8.8CVE-2026-32913EPSS 0.3%

    OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept…

  36. 6.9CVE-2026-31926EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  37. 6.9CVE-2026-28204EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  38. 9.8CVE-2026-23658EPSS 0.8%

    Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

  39. 8.1CVE-2026-32634EPSS 0.3%

    Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds c…

  40. 9.1CVE-2026-32633EPSS 0.5%

    Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are …

  41. 7.6CVE-2026-32606EPSS 0.1%

    IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physical access to the machine to access the …

  42. 6.5CVE-2026-21670EPSS 0.5%

    A vulnerability allowing a low-privileged user to extract saved SSH credentials.

  43. 5.3CVE-2026-3783EPSS 0.5%

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redi…

  44. 6.9CVE-2026-27777EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  45. 6.9CVE-2026-27027EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  46. 4.8CVE-2026-28714EPSS 0.2%

    Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

  47. 6.9CVE-2026-27770EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  48. 6.9CVE-2026-30796EPSS 0.5%

    Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) …

  49. 8.6CVE-2026-29128EPSS 0.3%

    IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are owned by root but world-readable. The configuration files (e.g., zebra.conf, bgpd.c…

  50. 6.0CVE-2026-0689EPSS 0.3%

    In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appea…