Weak credential policy
Description
The application's credential policy does not enforce the technical parameters required to resist guessing attacks: it allows passwords or passphrases below the recommended minimum length (or caps them below the recommended maximum), does not reject weak, word-based, previously breached, or context-specific credentials (e.g., username, app name), issues temporary passwords or OTPs (e.g., for account recovery, first login, or MFA) that are short-lived or short in name only, without sufficient entropy or length, and/or allows credentials to be shared or reused across multiple users or accounts.
Impact
Increase the chances of an attacker obtaining valid credentials through brute-force, dictionary, or credential-stuffing attacks, including via temporary passwords or OTPs issued during account recovery, onboarding, or MFA challenges.
Recommendation
- Require passphrases of at least four words or passwords of at least 20 characters, rather than short, word-based passwords, and do not impose an arbitrarily low maximum length that would reject strong passphrases. - Reject passwords found in known breach databases (e.g., via the HaveIBeenPwned API) and passwords built from context-specific words (e.g., username, service name) at creation and change time. - Generate temporary passwords and OTPs (recovery, first login, MFA, admin-issued) with sufficient entropy (temporary passwords: minimum 12 characters, mixed case, digits, and symbols; OTPs: minimum 6 digits) and force expiry after first use or within a short window (e.g., 15 minutes). - Require each user or system to have a unique, non-shared credential; reusing or sharing credentials across accounts prevents individual accountability and multiplies the impact of a single compromise. - Do not enforce arbitrary periodic password expiration without evidence of compromise: per NIST SP 800-63B, mandatory rotation leads users to choose weaker, predictable passwords. Enforce expiration only upon detected compromise, or per an applicable compliance requirement, and require MFA for all privileged accounts.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
⏱️ 30 minutes.
Requirements
130 - Limit password lifespan132 - Passphrases with at least 4 words133 - Passwords with at least 20 characters136 - Force temporary password change137 - Change temporary passwords of third parties139 - Set minimum OTP length143 - Unique access credentials332 - Prevent the use of breached passwordsRules
Aws Old Credentials EnabledAws Password Expiration UnsafeAws Password Reuse UnsafeAws Old Ssh Public KeysAws Not Requires NumbersAws Not Requires LowercaseAws Not Requires SymbolsAws Old Access KeysAws Min Password Length UnsafeAws Not Requires UppercaseApi Weak Password PolicyJson Yaml Weak Secret ConfigurationRust Diesel Sqlx Empty PasswordTypescript Bcrypt Unsafe Empty PasswordJavascript Jwt Unsafe Empty PasswordJavascript Sequelize Unsafe Empty PasswordJava Empty Password ConnectionC Sharp Weak Credential PolicyTypescript Crypto Unsafe Empty PasswordTerraform Weak Secret ConfigurationGo Mysql Empty Password In DsnTypescript Sequelize Unsafe Empty PasswordTypescript Jwt Unsafe Empty PasswordJavascript Bcrypt Unsafe Empty PasswordJavascript Crypto Unsafe Empty Password