Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2020-25229—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The implemented encryption for communicatioEPSS 0.6%CVE-2025-44963CRITICALRUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain sEPSS 0.6%CVE-2019-7594MEDIUMMetasys use of hardcoded RC2 keyEPSS 0.6%CVE-2024-46612CRITICALIceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.EPSS 0.6%CVE-2026-116747CRITICALKener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT SecretEPSS 0.6%CVE-2023-2158CRITICALImpersonation through User-Controlled TokenEPSS 0.6%CVE-2025-15107MEDIUMactiontech sqle JWT Secret jwt.go hard-coded keyEPSS 0.6%CVE-2024-1258LOWJuanpao JPShop API params.php hard-coded keyEPSS 0.6%CVE-2026-111692CRITICALDataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC SecretEPSS 0.6%CVE-2026-53709CRITICALMCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryEPSS 0.6%CVE-2026-22586CRITICALHard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, SubscrEPSS 0.6%CVE-2025-8625CRITICALCopypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code ExecutionEPSS 0.6%CVE-2023-0391HIGHMGT-COMMERCE CloudPanel Shared CertificateEPSS 0.6%CVE-2026-117564CRITICALnest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT SecretEPSS 0.6%CVE-2026-24218HIGHNVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keyEPSS 0.6%CVE-2026-52727HIGHlxc-ci: Pacman keyring stored in archlinux image with a private keyEPSS 0.6%CVE-2026-81855CRITICALWärtsilä FOS-Onboard Use of Hard-coded Cryptographic KeyEPSS 0.6%CVE-2022-2641CRITICALHorner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform uEPSS 0.6%CVE-2026-111690CRITICALSimple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication BypassEPSS 0.6%CVE-2024-2413CRITICALIntumit SmartRobot - Use of Hard-coded Cryptographic KeyEPSS 0.6%