CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- openclawOpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download6.0 Medium
- cert/cc cveclient/encrypt-storage.js, cmu cveclient +1 morePrivate Key stored as extractable in browser IndexeDB7.5 High
- floragunn search guard flx, search-guard flx +1 moreSearch Guard audit logs can contain under certain conditions user credentials4.9 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft9.3 Critical
- theunwindai awesome llm appsA cross-session information disclosure vulnerability exists in the awesome-llm-apps project in...8.2 High
- wazuh, wazuh (github actions) +1 moreWazuh GitHub Actions Workflow Exposure of Sensitive Credentials8.3 High
- opentext identity managerCache Misconfiguration Leading to Cross-User Data Exposure8.4 High
- openclawOpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots7.1 High
- saloonSaloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL6.6 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software5.1 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is vulnerable to disclosure of sensitive information6.5 Medium
- checkmkSession hijacking via exposed session signing secret in distributed Checkmk setups7.3 High
- igl-technologies eparking.fiIGL-Technologies eParking.fi Insufficiently Protected Credentials6.9 Medium
- ctek chargeportalCTEK Chargeportal Insufficiently Protected Credentials6.9 Medium
- microsoft azure devops: msazure, azure devops +1 moreAzure DevOps: msazure Elevation of Privilege Vulnerability8.6 High
- nicolargo glancesGlances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers8.1 High
- nicolargo glancesGlances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`9.1 Critical
- lxc incus-osIncusOS has a LUKS encryption bypass due to insufficient TPM policy7.7 High
- openclawOpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes8.6 High
- veeam backup and replication, backup \& replication +1 moreA vulnerability allowing a low-privileged user to extract saved SSH credentials.7.7 High
- curltoken leak with redirect and netrc5.3 Medium
- openclawOpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects8.8 High
- everon api.everon.ioEveron api.everon.io Insufficiently Protected Credentials6.9 Medium
- mobiliti e-mobi.huMobiliti e-mobi.hu Insufficiently Protected Credentials6.9 Medium
- acronis cyber protect 17, cyber protect +1 moreUnnecessary transmission of sensitive cryptographic material. The following products are affected...4.8 Medium
- epower epower.ieePower epower.ie Insufficiently Protected Credentials6.9 Medium
- rustdesk server, rustdesk-client rustdesk client +1 moreRustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync6.9 Medium
- international datacasting corporation sfx2100 satellite receiver, datacast sfx2100 firmware +1 moreIDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files8.6 High
- openclawOpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback6.3 Medium
- extreme networks extremecloud iq - site engine, extremenetworks extremecloud iq site engine +1 moreXIQ‑SE NAC Admin Credential Exposure via HTTP Response6.0 Medium
- google android, linuxfoundation yocto, mediatek, inc. mediatek chipset +3 more +5 moreIn preloader, there is a possible read of device unique identifiers due to a logic error. This...4.6 Medium
- gradio-app gradioGradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret0.0 None
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware6.9 Medium
- mobility46 mobility46.seMobility46 mobility46.se Insufficiently Protected Credentials6.9 Medium
- ev energy ev.energyEV Energy ev.energy Insufficiently Protected Credentials6.9 Medium
- switch ev swtchenergy.comSWITCH EV swtchenergy.com Insufficiently Protected Credentials6.9 Medium
- ev2go ev2go.ioEV2GO ev2go.io Insufficiently Protected Credentials6.9 Medium
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Insufficiently Protected Credentials6.9 Medium
- chargemap chargemap.comChargemap chargemap.com Insufficiently Protected Credentials6.9 Medium
- jinan usr iot technology limited (pusr) usr-w610Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials5.7 Medium
- openclawOpenClaw: Telegram bot token exposure via logs6.9 Medium
- suse harvesterNeuVector scanner insecurely handles passwords as command arguments3.8 Low
- moxa uc-1200a series, uc-1222a firmware, uc-2222a-t-ap firmware +33 more +35 moreMoxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique...7.0 High
- yugabytedb inc anywhereYugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI2.4 Low
- n8nDomain allowlist bypass enables credential exfiltration5.3 Medium
- edimax ew-7438rpn mini firmware, edimax technology ew-7438rpn mini +1 moreEdimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)8.7 High
- hcl aionHCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability3.7 Low
- chainguard malcontentmalcontent's OCI image scanning could expose registry credentials6.5 Medium
- tildeslash ltd. m/monit, tildeslash m\/monit +1 moreM/Monit 3.7.4 - Password Disclosure7.1 High
- tp-link omada controllerPassword Confirmation Bypass in Omada Controller2.1 Low
- Show moreLoading…