Skip to content
OpenAdvisories

Weakness (CWE)

CWE-262: Not Using Password Aging

Base Draft

The product does not have a mechanism in place for managing password aging.

More detail

Note that while password aging was once considered an important security feature, it has since fallen out of favor by many, because it is not as effective against modern threats compared to other mechanisms such as slow hashes. In addition, forcing frequent changes can unintentionally encourage users to select less-secure passwords. However, password aging is still in use due to factors such as compliance requirements, e.g., Payment Card Industry Data Security Standard (PCI DSS).

How to prevent it (2 mitigations)

  1. Architecture and Design

    As part of a product's design, require users to change their passwords regularly and avoid reusing previous passwords.

  2. Implementation

    Developers might disable clipboard paste operations into password fields as a way to discourage users from pasting a password into a clipboard. However, this might encourage users to choose less-secure passwords that are easier to type, and it can reduce the usability of password managers [REF-1294].

Source: MITRE CWE-262

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 8.1
    CVE-2026-50101

    Naxclow IoT Platform Not using password aging

    Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it…

    Naxclow X Smart Home ix cam Smart Doorbell X3
  • Medium 5.4
    CVE-2025-60010

    Junos OS and Junos OS Evolved: Device allows login for user with expired password

    A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change. Affected devices allow logins by users f…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 4.1
    CVE-2025-58435

    Open OnDemand didn't rotate password for VNC batch_connect

    Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to sha…

    OSC ondemand
  • Low 2.7
    CVE-2023-1555

    Missing Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-2022

    Missing Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on prot…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.8
    CVE-2022-22767

    BD Pyxis™ Products – Default Credentials

    Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined…

    Becton Dickinson (BD) BD Pyxis™ Logistics BD Pyxis™ SupplyRoller BD Pyxis™ MedStation™ 4000