CWE-522: Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Consequences

• Access Control: Gain Privileges or Assume Identity

How to prevent it

• Architecture and Design: Use an appropriate security mechanism to protect the credentials.
• Architecture and Design: Make appropriate use of cryptography to protect the credentials.
• Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Recent advisories

• EEF-CVE-2026-113440 — HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
• GHSA-3wp9-xfwm-rjjf — AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
• GHSA-jmqq-x5g9-9p2w — AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
• GHSA-rqf5-2wxv-rjf4 — AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
• GHSA-xr57-gcx8-52hf — AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request
• GHSA-f8m2-889x-vw4x — AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target
• GHSA-88f6-4rjv-x774 — Vikunja: TOTP secret is readable after enrollment, no step-up auth
• GHSA-486v-q2wf-fp2r — rclone: http backend forwards custom/auth headers to a different host on redirect
• GHSA-vx52-2968-3vc6 — pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
• GHSA-xjw5-q542-3vmr — Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
• GHSA-3jhr-mxmx-38cx — Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
• GHSA-8x84-r2ff-h8pq — SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking
• GHSA-34fj-mwm6-fjfg — SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
• GHSA-h4v5-crx2-3cv4 — SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers
• GHSA-gx4c-2hqx-cw2r — rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

All advisories for CWE-522