# Qualys QID 86728 - Web Server Uses Plain-Text Form Based Authentication

**URL:** <https://community.jenkins.io/t/qualys-qid-86728-web-server-uses-plain-text-form-based-authentication/625>\
**Category:** Ask a question\
**Created:** [October 21, 2021, 2:38pm UTC](https://community.jenkins.io/t/qualys-qid-86728-web-server-uses-plain-text-form-based-authentication/625 "2021-10-21T14:38:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DSP](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@DSP](https://community.jenkins.io/u/DSP)\
**Post date:** [October 21, 2021, 2:38pm UTC](https://community.jenkins.io/t/qualys-qid-86728-web-server-uses-plain-text-form-based-authentication/625/1 "2021-10-21T14:38:59Z")

</div>

Hi, it appears we are getting a vulnerability hit on Jenkins do to the Jenkins installation request for Unlocking Jenkins: “When you first access a new Jenkins instance, you are asked to unlock it using an automatically-generated password.” Is there a way to remove or comment this out?

#### Getting Started

# Unlock Jenkins

To ensure Jenkins is securely set up by the administrator, a password has been written to the log ([not sure where to find it?](https://jenkins.io/redirect/find-jenkins-logs)) and this file on the server:

`C:\Program Files (x86)\Jenkins\secrets\initialAdminPassword`

Please copy the password from either location and paste it below.

Administrator password

GET /login?next=/getting-started?next%3D/ HTTP/1.0

---

<div class="post-metadata">

**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\
**Post date:** [October 21, 2021, 6:06pm UTC](https://community.jenkins.io/t/qualys-qid-86728-web-server-uses-plain-text-form-based-authentication/625/2 "2021-10-21T18:06:48Z")

</div>

I believe it only does that if no users are defined. You can use something like [https://plugins.jenkins.io/configuration-as-code/](https://plugins.jenkins.io/configuration-as-code/) to auto configure it, or have a $JENKINS\_HOME mounted that has existing config files/users. You can disable the first run wizard, but without having something configured, i’m not sure how you’d get into your installation.