Weak Password Requirements
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-521: Weak Password Requirements |
| OWASP | A07:2021 - Identification and Authentication Failures |
| Confidence Level | Medium |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
Setting a user’s password to an empty string in Django makes the account easily guessable and insecure. Instead, use None or set_unusable_password() if you want to disable login for that user.
Impact#
If a user has an empty string as their password, anyone can log in to their account by submitting a blank password. This can lead to unauthorized access, data breaches, and compromise of user accounts and sensitive information.