CWE-256 Plaintext Storage of a Password
What this means
SiteShadow flagged a password being stored or handled without proper one-way password hashing (plaintext storage, reversible "encryption," or weak hashing).
Why it matters
If a database or log is leaked, plaintext passwords are immediately usable.
- Immediate account takeover if passwords are plaintext or reversible.
- Credential stuffing across other services because users reuse passwords.
- This is one of the clearest "high severity" auth failures.
Safer examples
1) Hash passwords with Argon2id/scrypt/bcrypt
from argon2 import PasswordHasher
ph = PasswordHasher()
stored_hash = ph.hash(password)2) Verify using the hashing library (constant time)
ph.verify(stored_hash, password_attempt)3) Never "decrypt passwords"
Passwords are verified, not decrypted. If you need a recoverable secret, store a separate secret with separate protection.
How SiteShadow detects it (high level)
- Flags password-like variables being persisted directly or passed through reversible transforms.
- Recognizes weak password handling patterns (base64/encoding, fast hashes in password contexts).
References
- CWE-256: https://cwe.mitre.org/data/definitions/256.html
---