CWE-836
Use of Password Hash Instead of Password for Authentication
The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
Impactr finds and proves whether CWE-836 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.