CWE-257 (以可恢复格式存储口令) — Vulnerability Class 59

CWE-257 represents a critical data storage weakness where passwords are kept in a recoverable format, such as reversible encryption or plaintext, rather than using one-way cryptographic hashing. This flaw is typically exploited by malicious insiders or attackers who gain access to the database, allowing them to decrypt stored credentials and engage in password reuse attacks across multiple systems. Because the original passwords can be retrieved, this practice offers no security advantage over storing them in plain text and significantly increases the blast radius of a breach. To avoid this vulnerability, developers must implement strong, salted hashing algorithms like bcrypt or Argon2, ensuring that passwords are irreversibly transformed and cannot be recovered even if the storage medium is compromised.