boneIO Black versions prior to 1.6.0 store sensitive passwords, including MQTT broker and web panel passwords, in cleartext. The API endpoint GET /api/config exposes these passwords to any authenticated user. Due to a related issue (CVE-2026-77053) where authentication is disabled by default, unauthenticated attackers on the same local network can also retrieve all passwords. Version 1.6.0 fixes this by hashing web panel passwords with salted scrypt and restricting access to password files, while MQTT broker passwords are stored securely and no longer exposed via the API.