Cyber Posture

CWE · MITRE source

CWE-523Unprotected Transport of Credentials

Abstraction: Base · CVEs in our corpus: 20

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (3)AI

Control Title Family Why it addresses this CWE
SC-37Out-of-band ChannelsSCUsing a distinct channel for credential transmission prevents unprotected transport over the application's normal communication path.
SC-8Transmission Confidentiality and IntegritySCRequiring protected transport for credentials directly mitigates unprotected credential transmission over networks.
SC-9Transmission ConfidentialitySCPrevents unprotected transport of credentials by mandating confidentiality mechanisms such as TLS for all sensitive data flows.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-251752.09.80.00242020-12-14
CVE-2017-167311.88.80.00102017-12-20
CVE-2024-15091.89.10.00092025-02-28
CVE-2025-578001.88.80.00102025-08-22
CVE-2025-643091.78.60.00102025-11-15
CVE-2021-320031.68.00.00042021-08-05
CVE-2025-619161.67.90.00022026-01-05
CVE-2021-384601.57.50.00642021-10-12
CVE-2022-318051.57.50.00282022-06-24
CVE-2023-312771.57.50.00102023-07-06
CVE-2025-611211.57.50.00042025-10-30
CVE-2025-643081.57.50.00042025-11-15
CVE-2025-660291.57.60.00062025-12-17
CVE-2025-417051.46.80.00032025-10-14
CVE-2024-11021.36.50.00092024-04-25
CVE-2024-203951.36.40.00212024-07-17
CVE-2026-236351.36.50.00042026-03-25
CVE-2023-228621.25.90.00092023-06-05
CVE-2023-287080.94.30.00102023-03-22
CVE-2024-41880.00.00.00082024-07-30