The product transfers or saves authentication credentials, but it does so improperly that it can be intercepted or retrieved by unauthorized individuals.
This flaw relates to an architectural security approach that has been misdesigned. Another form of credential attack uses flaws in how passwords are encoded, saved, and handled by a web application, network, or software system.
Risky development practices, such as storing passwords in insecure locations, storing credentials in plaintext, storing user passwords using poor or reproducible cryptographic techniques, or using hard-coded credentials, generate vulnerabilities that can be exploited to recover clients' credentials which can then be used to attack applications and other apps the user logs into.
An attacker could access user accounts and sensitive data stored within them.
To secure the credentials, use an appropriate security mechanism.
Creating a firm password policy in your organization, such as prohibiting the use of passwords found in recent data breaches or well-known weak passwords, or encouraging the use of long, randomly generated passwords in conjunction with password managers, to improve security.
• To protect the credentials, make proper use of cryptography. • To secure credentials, follow industry best practices (e.g. LDAP, Keystore, etc.)