Password submitted using GET method
Summary: PortSwigger Research describes applications that submit passwords using the GET method, which places them in the query string of the requested URL. Those URLs may be logged in the user's browser, the web server, and any forward or reverse proxy between the two endpoints, and may be disclosed to third parties through the Referer header when off-site links are followed.
What's compelling: A password sitting in a URL can be captured by an attacker and can leave a compromised audit trail that is extremely difficult to investigate, and users who re-used that password elsewhere are exposed even if the application itself only handles non-sensitive information.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026