Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2024-23687CRITICALFOLIO mod-data-export-spring Hard-Coded CredentialsEPSS 0.7%CVE-2023-46706CRITICALMachineSense FeverWarn Use of Hard-coded CredentialsEPSS 0.7%CVE-2019-17659LOWA use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH accEPSS 0.7%CVE-2024-28747CRITICALifm: Use of Hard-coded CredentialsEPSS 0.7%CVE-2024-29966HIGHhard-coded credentials in the documentation that appear as the appliance root passwordEPSS 0.7%CVE-2026-13768CRITICALGardyn IoT Hub Use of Hard-coded CredentialsEPSS 0.7%CVE-2023-53983CRITICALAnevia Flamingo XL/XS 3.6.20 Default Credentials Authentication BypassEPSS 0.6%CVE-2025-11126CRITICALApeman ID71 system.ini hard-coded credentialsEPSS 0.6%CVE-2024-41794CRITICALA vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for rEPSS 0.6%CVE-2026-69102CRITICALMaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trustEPSS 0.6%CVE-2026-85391CRITICALPeppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.ymlEPSS 0.6%CVE-2026-57148CRITICALpraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)EPSS 0.6%CVE-2021-44464MEDIUMFresenius Kabi Agilia Connect Infusion System hard coded credentialsEPSS 0.6%CVE-2024-11630MEDIUME-Lins H685/H685f/H700/H720/H750/H820/H820Q/H820Q0/H900 OEM Backend hard-coded credentialsEPSS 0.6%CVE-2022-39185CRITICALEXFO - BV-10 Performance Endpoint Unit Undocumented privileged user.EPSS 0.6%CVE-2024-41161HIGHVonets WiFi Bridges Use of Hard-coded CredentialsEPSS 0.6%CVE-2025-7401CRITICALPremium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.phpEPSS 0.6%CVE-2025-7768CRITICALUse of Hard-coded Credentials in Tigo Energy Cloud Connect AdvancedEPSS 0.6%CVE-2026-12628CRITICALHardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to systemEPSS 0.6%CVE-2023-40463HIGHUse of Hard-Coded CredentialsEPSS 0.6%