An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
CWE-261, CWE-522