Weaknesses of type CWE-321

425 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2026-8243MEDIUMIndustrial Application Software IAS Canias ERP JNLP Deployment Endpoint hard-coded keyEPSS 0.3%CVE-2026-81478HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthentEPSS 0.3%CVE-2023-34338HIGHhard coded cryptographic keyEPSS 0.3%CVE-2026-105392MEDIUMLybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded keyEPSS 0.3%CVE-2026-50091CRITICALAqara Home Android SDK hardcoded keysEPSS 0.3%CVE-2024-28989MEDIUMSolarWinds Web Help Desk Cryptographic Key Management VulnerabilityEPSS 0.3%CVE-2026-6580MEDIUMliangliangyy DjangoBlog Amap API Call views.py hard-coded keyEPSS 0.3%CVE-2024-3109MEDIUM A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for aEPSS 0.3%CVE-2023-21404MEDIUMAXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used iEPSS 0.3%CVE-2025-55449HIGHAstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.EPSS 0.3%CVE-2025-6071MEDIUMHard Coded Key used for AES encryptionEPSS 0.3%CVE-2026-8739MEDIUMSanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded keyEPSS 0.3%CVE-2026-4588MEDIUMkalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded keyEPSS 0.3%CVE-2026-108798MEDIUMZKTeco BioTime hard-coded keyEPSS 0.3%CVE-2025-58426MEDIUMdesknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applicatioEPSS 0.3%CVE-2024-13773HIGHCivi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information ExposureEPSS 0.3%CVE-2023-38535MEDIUMUse of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could EPSS 0.3%CVE-2026-82827CRITICALA hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokensEPSS 0.3%CVE-2025-54471MEDIUMNeuVector is shipping cryptographic material into its binaryEPSS 0.3%CVE-2025-30234HIGHSmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a DebEPSS 0.3%