Falhas do tipo CWE-259

222 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2026-108831MEDIUMmeetecho janus-gateway Admin API admin.js hard-coded credentialsEPSS 0.3%CVE-2024-27164HIGHHardcoded credentialsEPSS 0.3%CVE-2024-7155LOWTOTOLINK A3300R shadow.sample hard-coded passwordEPSS 0.3%CVE-2025-54754HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded PasswordEPSS 0.3%CVE-2025-1879LOWi-Drive i11/i12 APK hard-coded credentialsEPSS 0.2%CVE-2026-22054MEDIUMActive IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perEPSS 0.2%CVE-2026-22055MEDIUMActive IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to performEPSS 0.2%CVE-2025-47818LOWFlock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.EPSS 0.2%CVE-2025-47823LOWFlock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.EPSS 0.2%CVE-2025-9091LOWTenda AC20 shadow hard-coded credentialsEPSS 0.2%CVE-2024-46328HIGHVONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root.EPSS 0.2%CVE-2023-0808LOWDeye/Revolt/Bosswerk Inverter Access Point Setting hard-coded passwordEPSS 0.2%CVE-2024-46959MEDIUMrunofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1EPSS 0.2%CVE-2025-47821LOWFlock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.EPSS 0.2%CVE-2025-9309LOWTenda AC10 MD5 Hash shadow hard-coded credentialsEPSS 0.2%CVE-2024-33867MEDIUMAn issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.EPSS 0.2%CVE-2023-1944HIGH[minikube] ssh server with default passwordEPSS 0.2%CVE-2024-20412CRITICALA vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthEPSS 0.2%CVE-2026-65117MEDIUMNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successfulEPSS 0.2%CVE-2025-70802HIGHTenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows aEPSS 0.2%