CWE · MITRE source
CWE-523Unprotected Transport of Credentials
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
Last updated: 15 October 2026 20:36 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 2 mapping(s) from 1 framework(s): STIG rhel 8 2 (mostly)
OWASP Top 10 for Web (2025)
This weakness contributes to A04:2025 Cryptographic Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (3)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-8 | Transmission Confidentiality and Integrity | SC | graded full Requiring protected transport for credentials directly mitigates unprotected credential transmission over networks. |
SC-37 | Out-of-band Channels | SC | Using a distinct channel for credential transmission prevents unprotected transport over the application's normal communication path. |
SC-9 | Transmission Confidentiality | SC | Prevents unprotected transport of credentials by mandating confidentiality mechanisms such as TLS for all sensitive data flows. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2020-25175 UPD | 7.5 | 9.8 | 0.0115 | 2020-12-14 |
CVE-2024-1509 UPD | 6.8 | 9.1 | 0.0037 | 2025-02-28 |
CVE-2017-16731 UPD | 6.7 | 8.8 | 0.0072 | 2017-12-20 |
CVE-2025-57800 UPD | 6.6 | 8.8 | 0.0046 | 2025-08-22 |
CVE-2021-38460 UPD | 6.2 | 7.5 | 0.0181 | 2021-10-12 |
CVE-2022-31805 UPD | 6.0 | 7.5 | 0.0102 | 2022-06-24 |
CVE-2021-32003 UPD | 5.9 | 8.0 | 0.0023 | 2021-08-05 |
CVE-2023-31277 UPD | 5.9 | 7.5 | 0.0057 | 2023-07-06 |
CVE-2025-61121 UPD | 5.8 | 7.5 | 0.0030 | 2025-10-30 |
CVE-2026-54784 | 5.6 | 7.4 | 0.0027 | 2026-07-08 |
CVE-2025-61916 UPD | 5.5 | 7.9 | 0.0017 | 2026-01-05 |
CVE-2025-41705 UPD | 5.3 | 6.8 | 0.0046 | 2025-10-14 |
CVE-2025-64309 UPD | 5.3 | 7.4 | 0.0022 | 2025-11-15 |
CVE-2025-66029 UPD | 5.3 | 7.6 | 0.0020 | 2025-12-17 |
CVE-2024-1102 UPD | 5.2 | 6.5 | 0.0079 | 2024-04-25 |
CVE-2026-23635 | 5.0 | 6.5 | 0.0032 | 2026-03-25 |
CVE-2025-64308 UPD | 4.9 | 6.5 | 0.0023 | 2025-11-15 |
CVE-2024-20395 UPD | 4.8 | 6.4 | 0.0022 | 2024-07-17 |
CVE-2023-22862 UPD | 4.7 | 5.9 | 0.0054 | 2023-06-05 |
CVE-2026-8673 UPD | 4.6 | 5.9 | 0.0033 | 2026-05-22 |
CVE-2026-36610 UPD | 4.5 | 5.9 | 0.0019 | 2026-06-03 |
CVE-2023-28708 UPD | 4.1 | 4.3 | 0.0183 | 2023-03-22 |
CVE-2026-17620 UPD | 4.0 | 5.3 | 0.0013 | 2026-09-22 |
CVE-2026-56587 UPD | 3.2 | 3.7 | 0.0024 | 2026-07-21 |