Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2026-113466MEDIUMMinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded keyEPSS 0.4%CVE-2024-35344CRITICALCertain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B85EPSS 0.4%CVE-2026-119597CRITICALOpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token ForgeryEPSS 0.4%CVE-2026-85153CRITICALInformation Disclosure Vulnerability in Schmooze dating mobile ApplicationEPSS 0.4%CVE-2026-110474HIGHHardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre applicationEPSS 0.4%CVE-2024-42418HIGHAvtec Outpost Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2024-33849MEDIUMci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.EPSS 0.4%CVE-2025-35052MEDIUMNewforma Info Exchange (NIX) shared hard-coded secret keyEPSS 0.4%CVE-2026-100413HIGHSeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deploymentsEPSS 0.4%CVE-2025-45746MEDIUMIn ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service coEPSS 0.4%CVE-2025-22463HIGHA hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environmenEPSS 0.4%CVE-2026-111642HIGHFastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege EscalationEPSS 0.4%CVE-2024-52881HIGHAn issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is EPSS 0.4%CVE-2026-17468MEDIUMIBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionEPSS 0.4%CVE-2025-52373MEDIUMUse of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in databaseEPSS 0.4%CVE-2026-22906CRITICALHardcoded Key Allows Credential DisclosureEPSS 0.4%CVE-2026-76298HIGHUse of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk EnterpriseEPSS 0.4%CVE-2026-14932MEDIUMUnauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChartEPSS 0.4%CVE-2018-10896MEDIUMThe default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh hoEPSS 0.4%CVE-2026-76847HIGHact 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 BackendEPSS 0.4%