CWE-261
Weak Encoding for Password
Obscuring a password with a trivial encoding does not protect the password.
Impactr finds and proves whether CWE-261 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.