A civic helpdesk resets passwords using predictable temporary patterns. What finding class does this represent?

Predictable temporary password patterns used by a civic helpdesk represent a credential risk theme attackers can anticipate—reset formats that staff and citizens can guess from known municipal conventions. Calling helpdesk reset patterns out of scope because they are “operational, not technical” invents a false split: operational password issuance is still an identity control. Claiming predictable temps are safe if users must change them within thirty days ignores the window of exposure and the likelihood many users delay or weakly modify the pattern. Restricting this finding class to randomly generated MFA codes alone misunderstands the issue: predictability of issued secrets is the core problem, whether or not MFA exists elsewhere. Exam caveat: demonstrate the pattern class without mass-resetting real accounts or publishing live temporary passwords. Operational check: document the reset workflow from authorized observation or policy, show how the pattern is derived, recommend cryptographically random temps with forced unique change, and verify helpdesk tooling cannot fall back to seasonal slogans. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.