CWE-523 (凭证传输未经安全保护) — Vulnerability Class 21

CWE-523 represents a critical transport-level vulnerability where authentication credentials, such as usernames and passwords, are transmitted without adequate encryption or integrity protection. This weakness typically arises when developers fail to implement secure communication protocols like TLS or SSL, leaving data exposed in plaintext. Attackers exploit this by performing network sniffing or man-in-the-middle attacks to intercept and capture sensitive login information as it traverses the network. Once obtained, these credentials can be used for unauthorized access, identity theft, or further lateral movement within a system. To mitigate this risk, developers must enforce the use of HTTPS for all authentication endpoints, ensuring that data is encrypted in transit. Additionally, implementing strict security headers and validating certificate chains helps prevent interception, thereby safeguarding user credentials against eavesdropping and tampering during transmission.