CWE-549 (口令域未进行输入隐藏) — Vulnerability Class 12

CWE-549 represents a critical input validation weakness where software fails to obscure password characters during user entry, leaving sensitive credentials visible in plain text. This vulnerability is typically exploited through shoulder surfing or local screen capture attacks, allowing malicious actors to visually observe or record authentication details as they are typed. By exposing passwords to casual onlookers or nearby surveillance, the attack surface expands significantly without requiring complex technical intrusion. Developers can effectively mitigate this risk by implementing standard UI security practices, specifically configuring input fields to display masked characters such as asterisks or dots. Ensuring that password fields utilize appropriate type attributes or masking libraries prevents visual exposure, thereby safeguarding user credentials against immediate visual observation and maintaining the confidentiality of the authentication process.