CWE-836 (在认证机制中使用口令哈希代替口令) — Vulnerability Class 12

CWE-836 represents a critical authentication weakness where systems compare password hashes directly rather than verifying the original plaintext password. This flaw typically arises when clients generate password hashes locally to reduce server load or avoid transmitting sensitive data over the network. Attackers exploit this by capturing the transmitted hash, which serves as a static credential equivalent to the password itself. Since the hash remains constant, adversaries can replay it to gain unauthorized access without ever needing to crack the underlying password. To prevent this vulnerability, developers must ensure that authentication mechanisms require the transmission of the original plaintext password, which is then hashed and compared securely on the server side. This approach ensures that intercepted data cannot be reused for subsequent login attempts, thereby maintaining robust identity verification.