Category
Draft
CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Last updated
719
Recorded CVEs
With this primary CWE
0
KEVs
In the CISA KEV catalog
15
Weaknesses
In this category
Draft
Status
Per MITRE
Weaknesses in this category
- CWE-256: Plaintext Storage of a Password
- CWE-257: Storing Passwords in a Recoverable Format
- CWE-260: Password in Configuration File
- CWE-261: Weak Encoding for Password
- CWE-262: Not Using Password Aging
- CWE-263: Password Aging with Long Expiration
- CWE-324: Use of a Key Past its Expiration Date
- CWE-521: Weak Password Requirements
- CWE-523: Unprotected Transport of Credentials
- CWE-549: Missing Password Field Masking
- CWE-620: Unverified Password Change
- CWE-640: Weak Password Recovery Mechanism for Forgotten Password
- CWE-798: Use of Hard-coded Credentials
- CWE-916: Use of Password Hash With Insufficient Computational Effort
- CWE-1392: Use of Default Credentials
Real-world CVEs
719 recorded CVEs are caused by CWE-255 (Credentials Management Errors). The highest-severity and most recent are shown first. 2 new CWE-255 CVEs have been recorded so far in 2026 (3 in 2025).
- CVE-2016-0898Critical · CVSS 10.0 · EPSS 73th2018-03-29
- CVE-2015-7906Critical · CVSS 10.0 · EPSS 84th2015-12-21
- CVE-2015-7856Critical · CVSS 10.0 · EPSS 84th2015-10-16
- CVE-2010-5308Critical · CVSS 10.0 · EPSS 79th2015-08-04
- CVE-2011-5324Critical · CVSS 10.0 · EPSS 77th2015-08-04
- CVE-2012-6660Critical · CVSS 10.0 · EPSS 77th2015-08-04
- CVE-2002-2446Critical · CVSS 10.0 · EPSS 77th2015-08-04
- CVE-2001-1594Critical · CVSS 10.0 · EPSS 77th2015-08-04
- CVE-2011-5322Critical · CVSS 10.0 · EPSS 77th2015-08-04
- CVE-2009-5143Critical · CVSS 10.0 · EPSS 77th2015-08-04
- CVE-2011-5323Critical · CVSS 10.0 · EPSS 77th2015-08-04
- CVE-2012-6694Critical · CVSS 10.0 · EPSS 77th2015-08-04
Showing 12 of 719 recorded CWE-255 CVEs. Get an alert for each new one, with AI-written analysis and fixes.
Monitor these CVEsFrequently asked questions
Common questions about CWE-255.
- What is CWE-255?
- Weaknesses in this category are related to the management of credentials.
- What CVEs are caused by CWE-255?
- 719 recorded CVEs are attributed to CWE-255, including CVE-2016-0898, CVE-2015-7906 and CVE-2015-7856.
- Is CWE-255 actively exploited?
- 719 recorded CVEs are caused by CWE-255; none are currently in CISA's KEV catalog of actively exploited flaws.
Sources
- [1]Supplemental Details - 2022 CWE Top 25 (2022)
References
- MITRE CWE definition (CWE-255) (opens in a new tab)
- CWE-255 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.