Weak password validation increases account takeover risk

Password validators are not configured or are too permissive (e.g., minimum length below 12 characters), allowing users to set weak passwords vulnerable to brute force and dictionary attacks.

Enable and tune AUTH_PASSWORD_VALIDATORS with MinimumLengthValidator (min_length: 12), UserAttributeSimilarityValidator, CommonPasswordValidator, and NumericPasswordValidator. Consider using Argon2PasswordHasher as primary hasher. Test password requirements during user registration.