Summary

Oonchain password value can be read even if private.

Vulnerability Details

Any value stored on the blockchain can be read, even if declared as private.

Impact

Password value can be read by anyone.

Tools Used

For example with a JS script:
await web3.eth.getStorageAt(contractAddress, 1 /storageSlotNumber/);

Recommendations

Store only a hash, or an encrypted value.