CWE-522 Insufficiently Protected Credentials

Vikunja: TOTP secret is readable after enrollment, no step-up auth

Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth

Mechanize sends credential headers to another origin after a meta refresh

Mechanize sends credential headers to another host after an HTTP redirect

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Docling: Configured HTTP headers sent to every remote image host named by a document

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

rclone: http backend forwards custom/auth headers to a different host on redirect

Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

Duplicate Advisory: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

Duplicate Advisory: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

Duplicate Advisory: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking