Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2026-56269MEDIUMFlowise - Weak Default Token Hash Secret in JWT Token EncryptionEPSS 0.1%CVE-2025-59669MEDIUMA use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0EPSS 0.1%CVE-2023-20512LOWA hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug informaEPSS 0.1%CVE-2024-22313MEDIUMIBM Storage Defender - Resiliency Service information disclosureEPSS 0.1%CVE-2026-94592HIGHArmatura LLC Armatura One Use of Hard-coded CredentialsEPSS 0.1%CVE-2025-64778HIGHMirion Medical EC2 Software NMIS BioDose Use of Hard-coded CredentialsEPSS 0.1%CVE-2026-21404MEDIUMNAVTOR NavBox Use of Hard-coded CredentialsEPSS 0.1%CVE-2026-5522MEDIUMQRadar contains hard-coded credentialsEPSS 0.1%CVE-2022-37710HIGHPatterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption KEPSS 0.1%CVE-2026-32645CRITICALRed Lion Controls N-Tron 700 Series Use of Hard-Coded CredentialsEPSS 0.1%CVE-2026-63702MEDIUMDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attackEPSS 0.1%CVE-2026-107437MEDIUMPlaintext Database Password Exposure in GV-E-Map Server V18.2.0AEPSS 0.1%CVE-2025-59095MEDIUMHard-coded Key for PIN Encryption in dormakaba Kaba exos 9300EPSS 0.1%CVE-2026-93290MEDIUMUse of Hard-coded Credentials in Eufy Omni C20EPSS 0.1%CVE-2026-4219MEDIUMINDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentialsEPSS 0.1%CVE-2024-20280MEDIUMCisco UCS Central Software Configuration Backup Static Key VulnerabilityEPSS 0.1%CVE-2026-92861MEDIUMThe Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by theEPSS 0.1%CVE-2026-4216MEDIUMi-SENS SmartLog App air.SmartLog.android hard-coded credentialsEPSS 0.1%CVE-2025-14115HIGHIBM Sterling Connect:Direct for UNIX Container is affected by vulnerability where hard-coded credentials are embeeded in the product for its internal use.EPSS 0.1%CVE-2026-14866HIGHIBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesEPSS 0.1%