{
  "slug": "weak-password-policy",
  "url": "https://library.infinity8labs.com/weak-password-policy/",
  "title": "Weak password policy",
  "short": "Weak passwords",
  "aliases": [
    "Insufficient password policy",
    "Weak credential requirements",
    "Poor password controls"
  ],
  "summary": "A weak password policy permits short, common, compromised, or repeatedly guessed passwords. Attackers can exploit it through password spraying, credential stuffing, online guessing, or offline cracking after a data breach.",
  "cwe": [
    "CWE-521"
  ],
  "owasp": "A07:2021 Identification and Authentication Failures",
  "typical_severity": {
    "min": "medium",
    "max": "high"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-521: Weak Password Requirements",
      "url": "https://cwe.mitre.org/data/definitions/521.html"
    },
    {
      "title": "NIST SP 800-63B: Authenticators",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b/authenticators/"
    },
    {
      "title": "OWASP Authentication Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Password Storage Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
      "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/weak-password-policy/#overview",
    "https://library.infinity8labs.com/weak-password-policy/#impact",
    "https://library.infinity8labs.com/weak-password-policy/#examples",
    "https://library.infinity8labs.com/weak-password-policy/#remediation",
    "https://library.infinity8labs.com/weak-password-policy/#testing",
    "https://library.infinity8labs.com/weak-password-policy/#references"
  ]
}