Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2026-10557CRITICALYarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded CredentialsEPSS 0.4%CVE-2025-51606HIGHhippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source cEPSS 0.4%CVE-2020-3234HIGHCisco IOS Software for Cisco Industrial Routers Virtual Device Server Static Credentials VulnerabilityEPSS 0.4%CVE-2017-12350—A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to anEPSS 0.4%CVE-2026-11849CRITICALIEI Integration Corp｜iRM-IEI Remote Management - Hard-coded CredentialsEPSS 0.4%CVE-2023-50124MEDIUMFlient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination witEPSS 0.4%CVE-2025-10681HIGHGardyn Mobile Application and Device Firmware Use Hard-coded CredentialsEPSS 0.4%CVE-2023-41611MEDIUMVicture PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data.EPSS 0.4%CVE-2026-77427MEDIUMFileRise: Insecure default cryptographic key fallback in manual installsEPSS 0.3%CVE-2025-48414MEDIUMHard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stationsEPSS 0.3%CVE-2026-92928MEDIUMOpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential thEPSS 0.3%CVE-2026-68950HIGHUse of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product LineupsEPSS 0.3%CVE-2024-27107CRITICALWeak account password in GE HealthCare EchoPAC productsEPSS 0.3%CVE-2022-42176HIGHIn PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.EPSS 0.3%CVE-2026-111419HIGHHardcoded API Token in Foxit Official WebsiteEPSS 0.3%CVE-2026-61421CRITICALDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM AuthorizationEPSS 0.3%CVE-2026-105141MEDIUMtopoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentialsEPSS 0.3%CVE-2026-81964MEDIUMWindows Update Orchestrator Service Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-80134HIGHDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2026-12001MEDIUMHardcoded Credential Vulnerability in Multiple TP-Link Router ModelsEPSS 0.3%