A civic helpdesk resets passwords using predictable temporary patterns. What finding class does this represent?

Predictable temporary passwords and reset conventions create a guessable credential class independent of the user’s chosen long-term password. Adversaries who know organizational habits can target freshly reset accounts during the window before change. Assessments should treat this as credential hygiene and process risk, recommending strong random temps, short validity, and verification of identity at reset time. Operational practices are in-scope when they weaken authentication assurance.