• From BOL:

    Permissions

    Requires ALTER ANY CREDENTIAL permission to create or modify a credential and ALTER ANY LOGIN permission to map a login to a credential.

    Also from BOL:

    Members of the securityadmin fixed server role manage logins and their properties. They can GRANT, DENY, and REVOKE server-level permissions. They can also GRANT, DENY, and REVOKE database-level permissions if they have access to a database. Additionally, they can reset passwords for SQL Server logins.

    And this from 2008 R2 BOL (they don't have an updated version of this article):

    securityadmin - ALTER ANY LOGIN