Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-14651MEDIUMMartialBE one-hub docker-compose.yml hard-coded keyEPSS 0.4%CVE-2026-45433HIGHHardcoded Cryptographic Key Vulnerability in GX Earth ONT ModelsEPSS 0.3%CVE-2026-78481MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2025-46582HIGHPrivate Key Disclosure Vulnerability in ZTE ZXMP M721 ProductEPSS 0.3%CVE-2023-41137HIGHSymmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client andEPSS 0.3%CVE-2024-12078MEDIUMECOVACS lawnmowers and vacuums static BLE GATT encryption keyEPSS 0.3%CVE-2026-76258MEDIUMUse of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure GatewayEPSS 0.3%CVE-2026-7018MEDIUMDatavane Datavines JWT Token TokenManager.java hard-coded keyEPSS 0.3%CVE-2026-18411HIGHUse of hard-coded cryptographic key in Acrisure KARR BT and DR-100EPSS 0.3%CVE-2026-115739MEDIUMHard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrEPSS 0.3%CVE-2025-66454MEDIUMArcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsEPSS 0.3%CVE-2024-45837MEDIUMUse of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthentEPSS 0.3%CVE-2026-28742CRITICALNaxclow IoT Platform Use of hard-coded cryptographic keyEPSS 0.3%CVE-2021-32086CRITICALAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt sEPSS 0.3%CVE-2025-13877MEDIUMnocobase JWT Service jwt-service.ts hard-coded keyEPSS 0.3%CVE-2026-7306MEDIUMXuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded keyEPSS 0.3%CVE-2026-18330MEDIUMHardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7EPSS 0.3%CVE-2025-13948MEDIUMopsre go-ldap-admin JWT docker-compose.yaml hard-coded keyEPSS 0.3%CVE-2026-54833HIGHWordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerabilityEPSS 0.3%CVE-2025-15108MEDIUMPandaXGO PandaX JWT Secret config.yml hard-coded keyEPSS 0.3%