Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2026-14866HIGHIBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesEPSS 0.1%CVE-2024-7295HIGHHard-coded credentials used for temporary and cache data encryptionEPSS 0.1%CVE-2025-65855MEDIUMThe OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentiaEPSS 0.1%CVE-2026-36606HIGHMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in EPSS 0.1%CVE-2026-17644HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.1%CVE-2026-85422HIGHA vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the softwarEPSS 0.1%CVE-2025-37112MEDIUMHard-Coded Encryption Keys found in SystemEPSS 0.1%CVE-2025-12708MEDIUMMultiple Vulnerabilities in IBM Concert SoftwareEPSS 0.1%CVE-2026-84250HIGHIBM Guardium Data Protection Hard-coded CredentialsEPSS 0.1%CVE-2026-26334HIGHCalero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service CredentialsEPSS 0.1%CVE-2026-85488HIGHBrocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticaEPSS 0.1%CVE-2026-27873MEDIUM- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: beforeEPSS 0.1%CVE-2026-25600MEDIUMCredential Exposure Vulnerability in Trac PDBMEPSS 0.1%