CWE-499
Serializable Class Containing Sensitive Data
The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
Impactr finds and proves whether CWE-499 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.