CWE-263, Password Aging with Long Expiration, describes a product that supports password aging but sets the expiration period too long. It touches anyone who owns an authentication system, from a homegrown login form to a directory policy.
This one is unusual because the "fix" is contested. MITRE says so directly in its notes, and the honest version of this post has to as well.
How it happens
Password aging, also called rotation, forces users to pick a new password after a set period, such as every 30 or 90 days. If that period is long, an attacker who is cracking stolen password hashes has more time before the target password stops working. A password that never expires, or expires every few years, gives a cracked hash a long shelf life.
Teams end up here for ordinary reasons. Someone wanted fewer helpdesk tickets. A default was never revisited. Or the policy was copied from an old standard.
What an attacker gains
MITRE lists one consequence: gaining privileges or assuming another identity. The reasoning is simple. As a password ages, the probability that it has been compromised grows. An old, never-rotated credential is more likely to be sitting in a leaked database or a breach corpus.
How to find it
There is no code pattern to scan for. Check the policy instead:
- Look at the maximum password age in your identity provider, directory, and application settings.
- Check service accounts and shared accounts, which are the usual home of passwords nobody has changed in years.
- Ask whether any account has a "password never expires" flag set.
How to fix it
Do not reflexively switch to 30 day rotation. MITRE notes that password aging has fallen out of favor with many practitioners, because it is less effective against modern threats than other controls such as slow password hashes. It also notes that forcing frequent changes can push users toward weaker passwords.
A practical approach:
- Store passwords with a slow, salted hash so offline cracking is expensive.
- Rotate immediately when you have evidence of compromise, rather than waiting for a calendar.
- Where a compliance requirement such as PCI DSS demands rotation, set the interval to what the requirement says and document it.
- Prefer stronger controls where you can, such as multi-factor authentication.
Quick check
Is a shorter expiry always the answer to CWE-263?
No. MITRE points out that frequent forced changes can lead users to choose less secure passwords, and that slow hashes protect better against modern cracking. Use rotation where compliance requires it and rotate on suspected compromise.
Sources
- MITRE CWE-263: https://cwe.mitre.org/data/definitions/263.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-263
