Security misconfiguration means a system, application, or service is deployed with unsafe settings. Common examples include default passwords, overly permissive file or database access, unnecessary services left enabled, exposed admin panels, weak CORS rules, or verbose error messages that reveal internal details. The problem is often not a software bug, but a setup mistake.
In cyber security, this matters because a single bad setting can bypass otherwise strong controls. Attackers frequently scan for misconfigured cloud storage, public management interfaces, open directories, and forgotten test accounts. In authenticated portals, a misconfiguration can expose user records, session data, or administrative functions without needing to break encryption or guess passwords. Defenders reduce this risk by hardening baselines, disabling unused features, reviewing permissions, patching defaults, and continuously checking configurations against secure standards.