CWE-916 is a weakness class for password-hashing configurations that are too cheap to compute. In practice, this usually means a hash algorithm or work factor is set too low, so each password guess takes less time and less computing power than it should. The password is not exposed directly, but the protection around it is weakened.
This matters because attackers often steal password hashes from backups, exports, or compromised databases and then crack them offline. If the hashing cost is weak, they can test many guesses much faster and recover accounts more easily. Defenders reduce this risk by using modern password-hashing schemes, choosing a strong work factor, and protecting stored hashes with encryption, access control, and secure backup handling.