Skip to content
OpenAdvisories

Weakness (CWE)

CWE-522: Insufficiently Protected Credentials

Class Incomplete

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Use an appropriate security mechanism to protect the credentials.

  2. Architecture and Design

    Make appropriate use of cryptography to protect the credentials.

  3. Implementation

    Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Source: MITRE CWE-522

All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-84295 Public exploit

    Improper Authentication in Progress WS_FTP Server

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

    Progress Software WS_FTP Server
  • Critical 9.6
    CVE-2026-59891 Public exploit

    Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target regis…

    sigstore sigstore-js @sigstore/oci npm
  • Critical 9.1
    CVE-2026-45091 Public exploit

    sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

    sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unse…

    davidalmeidac sealed-env sealed-env io.github.davidalmeidac:sealed-env-core npm Maven
  • Critical 9.3
    CVE-2026-32913 Public exploit

    OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

    OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers l…

    OpenClaw OpenClaw openclaw npm
  • Critical 9.1
    CVE-2025-25650 Public exploit

    An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produ…

  • Critical 9.8
    CVE-2024-44000 Public exploit EPSS 82%

    WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

    Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

    LiteSpeed Technologies LiteSpeed Cache
  • Critical 9.9
    CVE-2024-9014 Public exploit

    OAuth2 client id and secret exposed through the web browser in pgAdmin 4

    pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.3
    CVE-2024-37051 Public exploit

    GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: Intelli…

    JetBrains IntelliJ IDEA PyCharm WebStorm
  • Critical 9.8
    CVE-2024-32238 Public exploit EPSS 53%

    H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be access…

  • Critical 9.8
    CVE-2022-45599 Public exploit

    Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, a…

  • Critical 9.8
    CVE-2022-37109 Public exploit EPSS 49%

    patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Acces…

  • Critical 9.8
    CVE-2022-35411 Public exploit EPSS 47%

    rpc.py vulnerable to Deserialization of Untrusted Data

    rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed…

    rpc-py PyPI
  • Critical 9.8
    CVE-2021-22681 Exploited Public exploit EPSS 64%

    Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key…

    KEV Mar 5, 2026
  • Critical 9.8
    CVE-2020-29583 Exploited Public exploit EPSS 90%

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-9160 Public exploit EPSS 76%

    SiCKRAGE Discloses Plaintext Credentials

    SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

    sickrage PyPI
  • Critical 9.8
    CVE-2017-9248 Exploited Public exploit EPSS 75%

    Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…

    KEV Nov 3, 2021