CWE · MITRE source
CWE-261Weak Encoding for Password
Obscuring a password with a trivial encoding does not protect the password.
Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. A programmer can attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password.
Last updated: 14 October 2026 20:41 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A04:2025 Cryptographic Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2017-7905 UPD | 7.6 | 9.8 | 0.0128 | 2017-06-30 |
CVE-2020-10275 UPD | 7.5 | 9.8 | 0.0096 | 2020-06-24 |
CVE-2025-31229 UPD | 7.0 | 9.1 | 0.0075 | 2025-07-30 |
CVE-2021-21507 UPD | 6.6 | 8.8 | 0.0054 | 2021-04-30 |
CVE-2024-28270 UPD | 6.1 | 8.1 | 0.0043 | 2024-04-08 |
CVE-2024-8455 | 6.1 | 8.1 | 0.0034 | 2024-09-30 |
CVE-2024-45273 UPD | 6.0 | 8.4 | 0.0009 | 2024-10-15 |
CVE-2022-38469 UPD | 5.9 | 7.5 | 0.0061 | 2023-01-18 |
CVE-2023-0525 UPD | 5.9 | 7.5 | 0.0068 | 2023-08-04 |
CVE-2024-24279 UPD | 5.9 | 8.8 | 0.0015 | 2024-04-08 |
CVE-2024-45394 UPD | 5.8 | 8.8 | 0.0009 | 2024-09-03 |
CVE-2022-45099 UPD | 5.7 | 7.8 | 0.0019 | 2023-02-01 |
CVE-2025-2862 UPD | 5.7 | 7.5 | 0.0021 | 2025-03-28 |
CVE-2020-14481 UPD | 5.6 | 7.8 | 0.0016 | 2022-02-24 |
CVE-2024-0556 UPD | 5.5 | 7.1 | 0.0041 | 2024-01-16 |
CVE-2026-63424 UPD | 5.3 | 7.3 | 0.0013 | 2026-08-13 |
CVE-2020-10919 UPD | 5.0 | 5.9 | 0.0159 | 2020-07-23 |
CVE-2023-0356 UPD | 4.6 | 5.7 | 0.0047 | 2023-01-26 |
CVE-2023-43776 UPD | 4.6 | 6.8 | 0.0012 | 2023-10-17 |
CVE-2024-37187 UPD | 4.6 | 5.7 | 0.0037 | 2024-09-27 |
CVE-2025-26401 UPD | 4.6 | 6.5 | 0.0017 | 2025-04-04 |
CVE-2026-67596 | 4.6 | 6.2 | 0.0012 | 2026-07-30 |
CVE-2023-7237 UPD | 4.5 | 5.7 | 0.0031 | 2024-01-23 |
CVE-2024-23492 UPD | 4.5 | 5.7 | 0.0024 | 2024-03-01 |
CVE-2025-67652 UPD | 4.5 | 6.1 | 0.0011 | 2026-01-22 |