I forced user password resets on a forum I run. It is powered by myBB. This is towards the edge of my knowledge circle but... It doesn't appear that any hashi

I forced user password resets on a forum I run. It is powered by myBB. This is towards the edge of my knowledge circle but... It doesn't appear that any hashing takes place client side[0] with myBB before the password is transmitted to the server, but I may have missed it when rechecking the code. Presumably that would mean in my case users who logged in potentially had their cleartext passwords pass through Cloudflare's network when they submitted their login details. Despite being behind https, when https is terminated at Cloudflare's edge and re-encrypted to my origin server (I use full/strict crypto setting), there was the possibility for decrypted data to be held in memory and then the possibility for it to be injected into the html pages of other sites when the bug was triggered. It would be a very very small probability of actually happening, but not zero. No details from the server should have leaked because only the content of transmitted data that passed over Cloudflare could have been leaked and the comparison of the provided password to the hashed/salted one in the database would have occurred on the server and not passed over the network. So the answer is it would depend on the way the sites you use handled password transmission and comparison. Personally I'd change them, and actually have done so for sites I use. [0] https://community.mybb.com/archive/index.php?thread-88668.html https://community.mybb.com/archive/index.php?thread-88668.ht...