CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav gravGrav before 2.0.16 Information Disclosure via Twig Sandbox8.7 High
- getgrav gravGrav before 2.0.16 Information Disclosure via offsetGet8.7 High
- ransomlookRansomLook API Key Disclosure Through /admin/apikeys HTML Source9.4 Critical
- dolibarrDolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints7.1 High
- bluewave-labs checkmateCheckmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled7.5 High
- infracostInfracost: Terraform Cloud and registry token disclosure via unvalidated hostname5.9 Medium
- cisco crosswork planningCisco Crosswork Security Hardening Release: August 20269.9 Critical
- insyde software insydeh2o, insydeh2o armHDD Password leakage vulnerability6.9 Medium
- ha-china blueprint-studioBlueprint Studio terminal SSH private key written to disk5.6 Medium
- ha-china blueprint-studioBlueprint Studio stored Git credentials in plaintext Git credential store6.9 Medium
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 more`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching6.0 Medium
- zabbixEmail media OAuth secret leak to Super Admin2.1 Low
- stirling-tools stirling-pdfStirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint8.5 High
- innotim software telecommunications and consulting trade ltd. co. logsign siemSensitive Data Exposure in Innotim Software's Logsign SIEM9.0 Critical
- budibaseBudibase before 3.40.0 Credential Exposure via STRING Fields8.3 High
- palo alto networks prisma browserPrisma Browser: Sensitive Information Disclosure Vulnerability0.5 Low
- palo alto networks prisma browserPrisma Browser: Inappropriate Implementation in Account Protection0.5 Low
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Encryption Key Material8.7 High
- siyuan-note siyuansiyuan before v3.7.4 Session Cookie Key Disclosure via getConf9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via /api/system/getConf9.2 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability6.5 Medium
- microsoft outlook, 365 apps, 365 apps for enterprise +6 more +8 moreMicrosoft Outlook Spoofing Vulnerability4.3 Medium
- red hat multicluster global hub 1.4.9, multicluster global hub 1.5.8, multicluster global hub 1.6.6 +2 more +4 moreMulticluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration6.3 Medium
- zyxel networks wah7601Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH76018.2 High
- aehrc pathlingPathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs8.7 High
- aehrc pathlingPathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration8.7 High
- rclonerclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect9.3 Critical
- rclonerclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect6.0 Medium
- rclonerclone before v1.75.0 Credential Exposure via S3 Redirect6.0 Medium
- hclsoftware hcl digital experience and digital experience composeHCL Digital Experience and Digital Experience Compose insufficiently protects credentials5.4 Medium
- statamic cmsStatamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable6.2 Medium
- esphomeESPHome web_server Plaintext Password Disclosure via JSON "value" Field6.5 Medium
- pterodactyl wingsWings exposes node configuration secrets through egg configuration-file templating9.9 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner9.3 Critical
- hcl software icontrolHCL iControl is affected by multiple security vulnerabilities.3.7 Low
- lmsys sglangCVE-2026-159777.5 High
- foreupforeUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials6.5 Medium
- gitlabInsufficiently Protected Credentials in GitLab5.4 Medium
- flytohub flyto-coreFlyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted8.6 High
- flytohub flyto-coreFlyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration9.3 Critical
- flytohub flyto-coreFlyto2 Core: LLM/API keys leak to an attacker-controlled base_url8.6 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`7.4 High
- schneider electric ecostruxure™ cybersecurity admin expertCWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication...8.7 High
- devolutions serverImproper access control in the NetBox synchronizer in Devolutions Server allows an authenticated...4.3 Medium
- openstack ironic python agentIn OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using...5.5 Medium
- filebrowserFile Browser: Share API exposes the password hash and bypass token2.7 Low
- guzzleguzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure6.9 Medium
- libgit2libgit2: HTTP transport can leak credentials to an offsite redirect target6.5 Medium
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 moreKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins4.3 Medium
- openclaw, openclaw msteams +1 moreOpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation6.0 Medium
- Show moreLoading…