CWE-261 (口令使用弱密码学算法) — Vulnerability Class 35

CWE-261 represents a critical weakness where developers mistakenly believe that trivial encoding, such as Base64, provides adequate security for stored passwords. This approach fails because encoding is merely a transformation for data representation, not a cryptographic protection mechanism, allowing anyone with access to the encoded string to easily reverse it and retrieve the original plaintext credentials. Attackers typically exploit this vulnerability by accessing configuration files or database dumps, decoding the weakly obscured passwords, and gaining unauthorized access to sensitive systems. To prevent this, developers must implement robust cryptographic hashing algorithms like bcrypt, Argon2, or PBKDF2 with appropriate salting. These methods ensure that even if the storage is compromised, the original passwords remain computationally infeasible to recover, thereby maintaining the integrity and confidentiality of user authentication data.