Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-2538CRITICALBUG-000174336EPSS 0.6%CVE-2026-42869CRITICALSOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC toolsEPSS 0.6%CVE-2021-27503—Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior tEPSS 0.6%CVE-2025-1393CRITICALWeidmueller: Authentication Vulnerability due to Hard-coded CredentialsEPSS 0.6%CVE-2026-111281CRITICALJooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded CredentialsEPSS 0.6%CVE-2024-42637CRITICALH3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.EPSS 0.6%CVE-2025-67304CRITICALIn Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In thEPSS 0.6%CVE-2024-42638CRITICALH3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as rooEPSS 0.6%CVE-2025-46273CRITICALPlanet Technology Network Products Use of Hard-coded CredentialsEPSS 0.6%CVE-2023-48251HIGHThe vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.EPSS 0.6%CVE-2021-35252HIGHCommon Key Vulnerability in Serv-U FTP ServerEPSS 0.6%CVE-2025-45784CRITICALD-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive usEPSS 0.6%CVE-2023-49253CRITICALPredefined root passwordEPSS 0.6%CVE-2026-45336CRITICALHireFlow: Use of Hard-coded CredentialsEPSS 0.6%CVE-2026-28777CRITICALHardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite ReceiverEPSS 0.6%CVE-2026-28776HIGHHardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite ReceiverEPSS 0.6%CVE-2026-29119HIGHHardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite ReceiverEPSS 0.6%CVE-2025-28230CRITICALIncorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials.EPSS 0.6%CVE-2023-25823MEDIUMGradio contains Use of Hard-coded CredentialsEPSS 0.6%CVE-2023-48374MEDIUMSmartStar Software CWS Web-Base - Use of Hard-coded CredentialsEPSS 0.6%