---
title: "Username Hash Found"
description: "HawkScan test information for plugin 10057: Username Hash Found"
url: https://docs.stackhawk.com/vulnerabilities/10057/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# Username Hash Found

###### Reference

- **Plugin ID:** 10057
- [**CWE:** 284](https://cwe.mitre.org/data/definitions/284.html)
- **WASC:** 2
- **Risk:** Unknown
- **Type:** Passive
- **Category:** Access Control

### Remediation

1. **Use indirect object references**: Replace direct username hashes with session-specific indirect references or UUIDs.
2. **Implement authorization checks**: Add proper authorization validation before accessing any user-specific resources.
3. **Remove unnecessary exposure**: Eliminate username hashes from responses unless absolutely required for functionality.
4. **Use per-user tokens**: Generate unique, non-predictable tokens for user identification instead of username-based hashes.
5. **Regular security testing**: Conduct IDOR testing to ensure proper access controls are in place.

### About

Username hash discovery occurs when applications expose hashed usernames in responses, URLs, or API calls. This can indicate potential Insecure Direct Object Reference (IDOR) vulnerabilities where attackers might manipulate these hashes to access other users' data or functionality.

### Risks

**Medium** Username hash exposure can enable IDOR attacks, allowing unauthorized access to other users' accounts, data, or functionality by manipulating predictable user identifiers in requests.