Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-54807CRITICALDover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2024-1920MEDIUMosuuu LightPicture TokenVerify.php handle hard-coded keyEPSS 0.7%CVE-2025-34217CRITICALVasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH KeyEPSS 0.7%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2025-34256CRITICALAdvantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication BypassEPSS 0.7%CVE-2024-6890CRITICALJournyx Unauthenticated Password Reset BruteforceEPSS 0.7%CVE-2025-27674CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.EPSS 0.7%CVE-2023-3404MEDIUMProfileGrid <= 5.5.0 - Hardcoded Encryption KeyEPSS 0.7%CVE-2026-28326HIGHSolarWinds Access Rights Manager Unauthenticated Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-44318MEDIUMAffected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could alloEPSS 0.7%CVE-2026-54363CRITICALCentreStack < 17.5 Hardcoded Key Token Forgery RCEEPSS 0.7%CVE-2022-26020MEDIUMAn information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A speEPSS 0.7%CVE-2024-30407CRITICAL[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacksEPSS 0.7%CVE-2025-15627MEDIUMHardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol AuthenticationEPSS 0.7%CVE-2025-11899CRITICALFlowring Technology｜Agentflow - Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2025-59407CRITICALThe Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow LicensEPSS 0.7%CVE-2026-62241CRITICALclawvet < 0.7.5 Hard-coded JWT Secret Session ForgeryEPSS 0.7%CVE-2022-2660CRITICALDelta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allowEPSS 0.7%CVE-2026-56271CRITICALFlowise - Weak Default JWT Secrets in Authentication MiddlewareEPSS 0.7%CVE-2018-3825—In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper accesEPSS 0.7%