While the UI warns us that the Credentials ID contains illegal characters, it's still possible to create it with those characters.
I suppose the validation is missing Jenkins.checkGoodName or similar.