cve.bz

CWE-522: Insufficiently Protected Credentials, page 7

Filter

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

What the weakness is: CWE-522 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 13
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-474 Signature Spoofing by Key Theft Likelihood: Medium · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-551 Modify Existing Service
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-522, as MITRE names them. Credits.

Ask an AI about CWE-522

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-522: Insufficiently Protected Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/522.html and https://cve.bz/cve/cwe/522?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.6CVE-2026-20435EPSS 0.1%

    In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. Us…

  2. 5.9CVE-2026-27167EPSS 0.5%

    Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth…

  3. 6.9CVE-2026-21660EPSS 0.3%

    A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and …

  4. 6.9CVE-2026-25774EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  5. 6.9CVE-2026-22878EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  6. 6.9CVE-2026-27773EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  7. 6.9CVE-2026-22890EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  8. 6.9CVE-2026-20791EPSS 0.4%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  9. 6.9CVE-2026-20733EPSS 0.3%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  10. 3.8CVE-2025-67860EPSS 0.1%

    A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, potentially exposing sensitive credentials to local users.

  11. 5.7CVE-2026-26049EPSS 0.3%

    The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observ…

  12. 6.9CVE-2026-27003EPSS 0.2%

    OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot<token>/...`). Prior to version 2026.2.15, OpenClaw logged these st…

  13. 5.3CVE-2026-25631EPSS 0.3%

    n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed an authenticated attacker to send requests with credentials to unintended domain…

  14. 7.0CVE-2026-0715EPSS 0.2%

    Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader men…

  15. 2.4CVE-2026-1966EPSS 0.2%

    YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to e…

  16. 8.7CVE-2020-37097EPSS 0.5%

    Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file. Attackers can access the script to retrieve sensitive information including WiFi ne…

  17. 6.5CVE-2025-52623EPSS 0.2%

    HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increa…

  18. 6.5CVE-2026-24845EPSS 0.4%

    malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a special…

  19. 7.1CVE-2020-36968EPSS 0.5%

    M/Monit 3.7.4 contains an authentication vulnerability that allows authenticated attackers to retrieve user password hashes through an administrative API endpoint. Attackers can send requests to the /api/1/admin/users/list and /api/1/admin…

  20. 2.1CVE-2025-9521EPSS 0.3%

    Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password without proper confirmation, leading to weakened account secu…

  21. 7.4CVE-2025-65098EPSS 0.3%

    Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript …

  22. 8.8CVE-2026-23958EPSS 0.5%

    Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the …

  23. 5.3CVE-2026-21852EPSS 28%

    Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-contr…

  24. 8.5CVE-2025-58742EPSS 0.2%

    Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle (AiTM) by m…

  25. 8.5CVE-2025-58741EPSS 0.2%

    Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables database access.This issue affects ImageDirector Capture: from 7.0.9 through 7.6…

  26. 6.9CVE-2026-1223EPSS 0.4%

    PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to allowing authenticated remote attackers to obtain SMTP plaintext passwords thr…

  27. 8.8CVE-2026-23742EPSS 0.5%

    Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline…

  28. 6.8CVE-2021-47759EPSS 0.1%

    MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH connection passwords through Windows PowerShell process listing. Attackers can run a PowerShell command to retrieve the full…

  29. 7.5CVE-2026-22911EPSS 0.5%

    Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device.

  30. 10.0CVE-2026-22240EPSS 3.4%

    The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP…

  31. 2.3CVE-2025-69271EPSS 0.2%

    Insufficiently Protected Credentials vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 24.3.13 and earlier.

  32. 5.7CVE-2026-22043EPSS 0.4%

    RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestr…

  33. 5.3CVE-2025-14524EPSS 0.7%

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target h…

  34. 4.9CVE-2025-62327EPSS 0.3%

    In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.

  35. 8.4CVE-2025-67732EPSS 0.4%

    Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party s…

  36. 8.8CVE-2025-64420EPSS 0.5%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Co…

  37. 7.2CVE-2025-64122EPSS 0.09%

    Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller (MSC): through 2.5.1.

  38. 8.7CVE-2021-47741EPSS 0.3%

    ZBL EPON ONU Broadband Router V100R001 contains a privilege escalation vulnerability that allows limited administrative users to elevate access by sending requests to configuration endpoints. Attackers can exploit the vulnerability by acce…

  39. 8.7CVE-2021-47726EPSS 0.3%

    NuCom 11N Wireless Router 5.07.90 contains a privilege escalation vulnerability that allows non-privileged users to access administrative credentials through the configuration backup endpoint. Attackers can send a crafted HTTP GET request …

  40. 9.3CVE-2025-15113EPSS 0.5%

    Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overw…

  41. 7.6CVE-2025-66029EPSS 0.2%

    Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node tha…

  42. 6.5CVE-2025-14148EPSS 0.3%

    IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token.

  43. 9.1CVE-2025-58130EPSS 0.4%

    Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to version 1.13.0, the latest release.

  44. 8.7CVE-2020-36896EPSS 0.9%

    QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin …

  45. 5.3CVE-2025-64898EPSS 0.4%

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain un…

  46. 5.7CVE-2025-63361EPSS 0.3%

    Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext.

  47. 3.5CVE-2025-13758EPSS 0.3%

    Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.

  48. 6.9CVE-2025-13164EPSS 0.4%

    EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.

  49. 6.9CVE-2025-13163EPSS 0.4%

    EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.

  50. 5.5CVE-2025-13187EPSS 0.6%

    A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipulation of the argument NomeUsuario/SenhaAcess leads to unprotected storage of cre…