{
  "id": 8520234,
  "title": "Dumping Every User's Plaintext Password Without Touching the Database",
  "url": "https://urgent.news/2026/09/19/dumping-every-users-plaintext-password-without-touching-the-database",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-19T19:00:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/oopssec-store/dumping-every-users-plaintext-password-without-touching-the-database-34ob"
  },
  "original_language": "en",
  "account": "A forgotten debug statement in an online store app logged plaintext passwords in error logs. These logs ended up on a hidden SIEM dashboard with default login credentials. The app's URL is http://localhost:3000. A directory brute-forcer found the /monitoring/siem endpoint. Logging the email, password, and a flag in plaintext allowed retrieval of the flag OSS{pl41nt3xt_p4ssw0rd_1n_l0gs}. Common vulnerabilities included logging sensitive request data, using plaintext logs, unlisted internal tools, and default credentials. To fix this, avoid logging sensitive data, use structured logging with field redaction, treat logs as sensitive, secure internal tools with strong credentials, and regularly review logs for sensitive information.",
  "summary": "Exploiting a forgotten debug statement that logs plaintext passwords and a hidden SIEM dashboard with hardcoded credentials to retrieve a flag. Someone left a debug log in the login route that dumps passwords in plaintext. Those logs end up on a hidden SIEM dashboard protected by default credentials. We'll find it, log in, and read everyone's passwords. Lab setup From an empty directory: npx…",
  "key_points": [
    "Debug statement logged plaintext passwords in error logs",
    "Hidden SIEM dashboard with default credentials exposed",
    "Flag retrieved via directory brute-forcing and logging oversight"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}