Edit history

CWE-209 - Login Form Discloses Password Length Constraints Through Validation Error has not been edited, so there are no earlier versions.

Current version | Original by Gustavo Barros
Show

CWE-209 - Login Form Discloses Password Length Constraints Through Validation Error

Reproduction steps

Navigate to the Fluxer login page. Enter a username, such as Admin. Enter a password containing fewer than eight characters, such as 123456. Attempt to sign in or trigger the form's validation. Observe the validation messages displayed beneath the username and password fields.

Expected behaviour

The login interface should provide a clear, user-friendly validation message without exposing raw schema-validation terminology.

Actual behaviour

Should show Invalid login or password

Platform

Self-hosting