Session disclosure inside the log files

Admin login cookies are saved in plain text in log files, allowing attackers to steal them and gain unauthorized access to administrator accounts.

CWE-1295 involves storing sensitive authentication tokens in plaintext logs accessible to threat actors. An attacker with log file access can extract admin session cookies and use them to bypass authentication controls. This requires local or remote log access but enables complete account takeover of administrative accounts.