Password Returned in Later Response

Password Returned in Later Response vulnerability allows attackers to capture user credentials. By sending the password in subsequent responses, the application exposes sensitive information and increases the risk of unauthorized access.

The risk is that an attacker might capture the user passwords. Vulnerabilities such as weaknesses in session handling, broken access controls, or cross-site scripting, could enable the attacker to leverage this behavior to retrieve the passwords of other application users.

Once a login is complete, do not send the password in any following responses. Use strong passwords and store them hashed on the server-side only, if necessary.