CTFer.io's CTFd Terraform Provider improperly stores team passwords as non-sensitive values in the Terraform state file. This allows local or remote attackers with access to the Terraform state to read team passwords without needing the state decryption password. The vulnerability is identified as CWE-522 and affects versions from 0.1.5 through 1.1.0 and all versions prior to 2.8.2. A patch is available in version 2.8.2. No workaround exists, but limiting access to the Terraform state file is recommended to reduce risk.