Insufficiently Protected Credentials
CWE-522
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
We track 328 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 5 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
Latest Insufficiently Protected Credentials vulnerabilities
- 7.8 High severity
Brocade Active Support Connectivity Gateway: Insufficiently Protected Credentials
In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or mana
- 9.4 Critical severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related pr
- 7.5 High severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rath
- 8.7 High severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malici
- 9.1 Critical severity
Cisco License On-Prem: Insufficiently Protected Credentials
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review re
- 7.5 High severity
typescript-sdk: Insufficient Verification of Data Authenticity
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorizat
- 9.6 Critical severity
twenty: Insufficiently Protected Credentials
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plain
- 8.4 High severity
Eclipse Che: External Control of File Name or Path
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list and returns t
- 8.2 High severity
pictshare: Insufficiently Protected Credentials
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a fi
- 7.1 High severity
n8n: Insufficiently Protected Credentials
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modi
- 8.8 High severity
YSSD-RTMP-H5: Insufficiently Protected Credentials
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.
- 8.1 High severity
authentik: Exposure of Sensitive Information to an Unauthorized Actor
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change t
- 7.7 High severity
DataStage on Cloud Pak for Data: Insufficiently Protected Credentials
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or envi
- 7.1 High severity
Financial Transaction Manager (FTM) for RedHat…: Insufficiently Protected Credentials
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.
- 8.1 High severity
homebox: Insufficiently Protected Credentials
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An
- 9.4 Critical severity
obsidian-web-mcp: Missing Authentication for Critical Functionality
Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authent
- 7.6 High severity
omni: Exposure of Sensitive Information to an Unauthorized Actor
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in i
- 9.8 Critical severity
Launcher: Improper Limitation of a Pathname to a Restricted Directory
GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.cha
- 7.5 High severity
async-http-client: Cleartext Transmission of Sensitive Information
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the orig
- 9.9 Critical severity
Cisco Identity Services Engine Software: Insufficiently Protected Credentials
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review
- 10.0 Critical severity
Apache Storm Nimbus: Insufficiently Protected Credentials
Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only t
- 8.4 High severity
MISP: Improper Neutralization of Escape, Meta, or Control Sequences
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-
- 8.2 High severity
Snowflake Connector for Python: Unintended Proxy or Intermediary
In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configur
- 9.8 Critical severity
NX10: Insufficiently Protected Credentials
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a va
- 9.4 Critical severity
SAP Cloud Application Programming Model (CAP): Insufficiently Protected Credentials
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse t
- 7.1 High severity
nebula-mesh: Cleartext Storage of Sensitive Information
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value
- 7.5 High severity
Netezza Software: Insufficiently Protected Credentials
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially
- 7.5 High severity
stable-diffusion-webui: Insufficiently Protected Credentials
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access thi
- 7.5 High severity
mariadb-connector-nodejs: Improper Certificate Validation
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials
- 7.5 High severity
gitoxide: Insufficiently Protected Credentials
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity)
- 8.1 High severity
Smart Home: Insufficiently Protected Credentials
Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.
- 7.5 High severity
urllib: Exposure of Sensitive Information to an Unauthorized Actor
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.
- 7.5 High severity
grav: Insufficiently Protected Credentials
Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve
- 9.4 Critical severity
ransomlook: Exposure of Sensitive Information to an Unauthorized Actor
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/
- 7.5 High severity
Checkmate: Exposure of Sensitive Information to an Unauthorized Actor
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticate
- 8.5 High severity
cloudnative-pg: Plaintext Storage of a Password
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/man
- 9.9 Critical severity
Cisco Crosswork Planning: Insufficiently Protected Credentials
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internall
- 8.5 High severity
Stirling-PDF: Exposure of Sensitive Information to an Unauthorized Actor
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects
- 9.0 Critical severity
Logsign SIEM: Insufficiently Protected Credentials
Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114.
- 7.7 High severity
budibase: Insufficiently Protected Credentials
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource c