U.S. Dept Of Defense: hardcoded password stored in javascript of https://████.mil

Summary: I have discovered a cleartext password stored within a javascript. This password allows me to authentication to https://█████.mil. Description: I have discovered a cleartext password stored within a javascript. This password allows me to authentication to https://███████.mil. To confirm this vulnerability we will first navigate to https://███████.mil, you are now prompted to type a password. We will provide an incorrect password such as 'Password'. ██████████ ███ We can confirm the password is invalid. However, reviewing the javascript data for '██████.chunk.js' we can confirm the authentication is validated based on a hardcoded password '█████████!'. ███████ We can now confirm if we can access the staging web app using hardcoded password. ██████ ███████ Impact By knowing the password, it is possible to understand your password policy and structure which will encourage bruteforcing and password spray attacks in your environment. Step-by-step Reproduction Instructions Navigate to https://█████████.mil. Open your browser debugger by pressing F12. Click on Network and refresh the page. Open the javascript '██████████.chunk.js' and look for where the password is stored. You will see "(n=prompt("Enter Password","Password"),o="██████;" copy the password. Now close out your browser debugger and refresh the page and type the password in. You now have access to ████████.mil Suggested Mitigation/Remediation Actions If this staging web application needs to be password...