CWE-261 Weak Encoding for Password
What this means
SiteShadow flagged a password being "encoded" (base64, reversible transformations, simple obfuscation) instead of being hashed with a proper password hashing function.
Why it matters
Encoded passwords can be trivially reversed and abused.
- Immediate compromise if encoded passwords leak (they can be decoded).
- Users often reuse passwords, so one leak becomes many account takeovers.
Safer examples
1) Hash passwords with a password hashing algorithm
from argon2 import PasswordHasher
ph = PasswordHasher()
stored_hash = ph.hash(password)2) Never store "reversible" passwords
If you can recover the password, so can an attacker who gets your data.
3) Fix legacy migrations safely
If migrating from legacy storage:
- force password reset, or
- re-hash on next login after verifying legacy format
How SiteShadow detects it (high level)
- Flags password-like variables passed through reversible encodings (base64/hex) or stored directly.
- Detects missing use of password hashing libraries in password storage flows.
References
- CWE-261: https://cwe.mitre.org/data/definitions/261.html
---