Document password hash disclosure in User Update API

vulnerability: password in response.md

@@ -0,0 +1,81 @@
+# Password Hash Disclosure in User Update API
+
+## Severity
+HIGH
+
+## CVSS Score & Vector
+**CVSS v3.1: 7.5 (High)**  
+**Vector:** AV:N / AC:L / PR:L / UI:N / S:U / C:H / I:N / A:N
+
+
+## Vulnerability Description
+
+The user update API endpoint returns the user's password hash in the HTTP response body after a successful update request. Although the password is stored using a strong hashing algorithm (`pbkdf2_sha256`), exposing password hashes constitutes disclosure of sensitive authentication material.
+
+Password hashes must remain strictly server-side. Their exposure enables offline password cracking, facilitates credential reuse attacks, and significantly increases the impact of other vulnerabilities such as IDOR, XSS, or token compromise.
+
+This issue indicates improper serialization of the User model, resulting in the inclusion of the `password` field in API responses.
+
+---
+
+## Proof of Concept
+
+### Request
+
+```json
+PATCH /api/users/26/ HTTP/2
+Host: dev-us-west-1.aixblock.io
+Content-Type: application/json
+Cookie: sessionid=<valid_session_cookie>
+
+{
+"first_name": "test",
+"last_name": "user"
+}
+```
+
+### Response
+```json
+HTTP/2 200 OK
+Content-Type: application/json
+
+{
+"id": 26,
+"username": "testuser",
+"email": "[email protected]
+",
+"password": "pbkdf2_sha256$26HGYxAMAF7Tzg$D/wsmvVBUicTt7Y1vohQvrwWjw52gDoeYvXq2VHzNPU=",
+"is_active": true,
+"is_verified": true
+}
+```
+
+
+The `password` field containing the password hash is returned directly in the API response.
+
+---
+
+### Impact
+High — enables offline password cracking, credential reuse attacks, and significantly increases the blast radius when chained with other vulnerabilities.
+
+---
+
+## Recommendation
+
+- Exclude the `password` field from all API serializers used in responses.
+- Mark password fields as `write_only` where input is required.
+- Implement dedicated password management endpoints for password changes.
+- Conduct a review of all API responses to ensure no sensitive authentication material is exposed.
+
+---
+
+## Reference Links
+- https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure/
+- https://cwe.mitre.org/data/definitions/522.html
+- https://cwe.mitre.org/data/definitions/532.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
+- https://docs.djangoproject.com/en/stable/topics/auth/passwords/
+
+# Screenshot:
+
+<img width="1459" height="770" alt="image" src="https://github.com/user-attachments/assets/819553df-8e05-4142-98ff-386d58d6fc08" />