CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- siderolabs omniOmni: Reader-level users can retrieve imported cluster CA keys via ResourceService7.6 High
- progress sitefinityCWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity8.7 High
- progress sitefinityCWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity10.0 Critical
- strongdm desktop application, desktop client +1 moreUnencrypted storage of authentication state in StrongDM Desktop Application state.kv file2.0 Low
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 credentials could be exposed in thread names6.5 Medium
- danelec macgregor voyage data recorder (vdr) g4e, macgregor interschalt vdr g4e firmware +1 moreMacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials5.9 Medium
- synology surveillance stationInsufficiently protected credentials vulnerability in IPSpeaker component in Synology...4.9 Medium
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials4.3 Medium
- hapijs wreck@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects6.3 Medium
- besen bs20 ev charging stationBesen BS20 EV Charging Station BLE/UDP insufficiently protected credentials5.1 Medium
- baptistearno typebot.ioTypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint7.1 High
- digital operation services wifiburadaOTP Bypass in Digital Operation Services' WifiBurada7.1 High
- codesys visualizationCODESYS Visualization - Insufficiently Protected Credentials6.9 Medium
- haxtheweb haxcms-nodejs, haxcms-php +1 moreHAXcms: Mass Token Exfiltration and Cross-Tenant Hijack8.7 High
- mattermost, mattermost server +1 morePrevent password disclosure and force reset during Slack import6.5 Medium
- hcl aionHCL AION is affected by a vulnerability where basic authorization tokens are used for authentication3.0 Low
- flowiseai flowiseFlowise: Basic Auth Credentials Exposed via API7.5 High
- dragonmonk111 junoclawJunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter9.8 Critical
- oalders lwp::useragentLWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects6.5 Medium
- davidalmeidac sealed-envsealed-env: TOTP secret embedded in unseal token payload (enterprise mode)9.1 Critical
- apple macosThis issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.5. An...4.6 Medium
- socfortress copilotSOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools10.0 Critical
@cyclonedx/cdxgennpm@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry6.9 Medium- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials4.8 Medium
- hcl bigfix runbookaiHCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability2.7 Low
- zabbixAgent 2 Oracle plugin TNS connection string injection via the 'service' parameter5.1 Medium
- gitoxidelabs gitoxidegitoxide 0.25.4 HTTP Credential Leak via Redirect7.6 High
- argoproj argo workflows, argo-workflows +1 moreArgo Workflows: Exposure of artifact repository credentials8.5 High
- geovision gv-lpc2011 firmware, gv-lpc2211 firmware, geovision inc. gv-lpc2011/lpc2211 +2 moreGeoVision LPC2011/LPC2211 Web Interface / ssi.cgi privilege escalation vulnerability via leak of Administrator credentials6.5 Medium
- bplugins my social feeds – social feeds embedder plugin for wordpressMy Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action5.4 Medium
- apple container, macos +1 moreUsers who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.6.5 Medium
- curlproxy credentials leak over redirect-to proxy5.9 Medium
- dell idrac10, idrac10 firmware +1 moreDell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected...7.1 High
- tufantunc ssh-mcptufantunc ssh-mcp Command Line index.ts insufficiently protected credentials4.8 Medium
- openclawOpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenv4.1 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Insufficiently Protected Credentials9.3 Critical
- tanium serverTanium addressed an information disclosure vulnerability in Tanium Server.2.7 Low
- go-gitgo-git Credential leak via cross-host redirect in smart HTTP transport4.7 Medium
- sparx systems pty ltd. enterprise architectSparx Enterprise Architect Client reveals plaintext OAuth2 client secret6.2 Medium
- dell powerprotect data domain boostfs, data domain operating system +1 moreDell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5,...7.8 High
- flowiseai flowiseFlowise: Sensitive Data Leak in public-chatbotConfig7.7 High
- kyvernoKyverno before 1.16.4 Credential Leak via apiCall8.3 High
- sparx systems pty ltd. enterprise architectSparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication5.7 Medium
- dgraphDgraph: Unauthenticated pprof endpoint leaks admin auth token9.4 Critical
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability8.8 High
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreA storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0...4.1 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreA storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0...4.1 Medium
- fortinet fortisandbox, fortisandbox paas, fortisandbox cloud +2 moreA insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5...2.5 Low
- sap hana cockpit, hana database explorer, sap se hana cockpit and hana database explorer +2 moreInformation Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer5.0 Medium
- haxtheweb haxiamHAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses8.7 High
- Show moreLoading…