Cleartext submission of password
Summary: PortSwigger describes a vulnerability where applications transmit passwords over unencrypted connections, allowing an attacker positioned to eavesdrop on the victim's network traffic to intercept them. The exposure typically occurs over insecure connections such as public Wi-Fi or a shared corporate or home network with a compromised computer, and common defenses like switched networks do not prevent it.
What you should know: An attacker in the user's ISP or the application's hosting infrastructure can perform this attack, and password disclosure produces compromises that are extremely difficult to investigate because audit trails are obscured. Even applications handling only non-sensitive information put users who reused their password elsewhere at risk.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026