Security Advisory: Password Hints Stored in Plain Text
Date: 9. 9. 2026
Severity: 2.3 (Low)
CVSS 3.1 Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected versions: midPoint 4.7 and all later versions prior to 4.8.14, 4.9.9, 4.10.5
Fixed in versions: 4.8.14, 4.9.9, 4.10.5, 4.11
Description
The password hint (credentials/password/hint) was stored in the midPoint repository as a plain string.
Unlike the password value and other credential data, the hint was not encrypted at rest.
Anyone with access to the repository database, its backups, or to raw exports of user objects could read the hints of all users. Users tend to write hints that are closely related to their passwords, or even the password itself, so a disclosed hint may significantly weaken the password.
This vulnerability requires:
-
Attacker to have access to the repository database, a database backup, or a raw export of user objects
-
Users to have password hints set (the hint is optional and empty by default)
Severity and Impact
This is Low Severity Issue.
The hint is not a secret by design: it is shown to the user during login when the password hint authentication module is configured. However, it was not protected in the same way as the other credential data, so it was exposed to anyone with direct access to the stored data. Depending on what users wrote into their hints, this may reveal their passwords or make them easy to guess.
Deployments that do not use password hints are not affected.
Mitigation
Users of affected midPoint versions are advised to upgrade to the latest maintenance releases: 4.8.14, 4.9.9, or 4.10.5.
The upgrade alone protects only hints that are created or changed after the upgrade. Hints that were stored before the upgrade remain in plain text until they are changed. To encrypt all existing hints at once, run the migration task described in the migration guide after the upgrade.
If immediate upgrade is not possible:
-
Restrict access to the repository database and its backups - only trusted administrators should be able to read the stored data
-
Review existing hints - consider clearing the hints of users, or asking users not to put their password or parts of it into the hint
Discussion and Explanation
The type of the password hint was changed from a plain string to ProtectedStringType, the same type that is used for the password value.
New and modified hints are encrypted by midPoint before they are stored in the repository,
and they are handled by the same encryption checks as other protected values.
Hints stored by previous versions are still read correctly and are tolerated by the encryption checks, so users with an old plain text hint can log in and be modified as before. Such a hint is encrypted only when it is changed. The migration task encrypts the remaining plain text hints in a single pass.
The change is also visible to API clients: the hint is now returned as a protected string structure instead of a plain string. Clients that write the hint may still send a plain string, it is accepted and encrypted.
Audit records of operations that changed a hint contain the hint value as protected string in the audit trail; records created before the fix contain it in plain text.
See MID-12111 for details.
Credit
This issue was found internally by the Evolveum team.