CWE-1391Use of Weak Credentials

Description

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

Common consequences

• Access Control→Bypass Protection Mechanism
  When credentials are easily predictable or even fixed (as with default or hard-coded passwords and keys), an adversary could bypass intended authentication restrictions without relying on brute force guessing. Even if a new, unique credenti

Potential mitigations

• Architecture and Design,Operation
  When the user changes or sets a password, check the password against a database of already compromised or breached passwords. These passwords are likely to be used in password guessing attacks.

Related CWEs

Recent CVEs classified under this CWE