password-disclosure 1 IDOR – Password Disclosure via Insecure Direct Object Reference | User ID Controlled by Request Parameter Mar 29, 2026