Falhas do tipo CWE-321

360 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2026-45433HIGHHardcoded Cryptographic Key Vulnerability in GX Earth ONT ModelsEPSS 0.3%CVE-2026-54218HIGHTeamDavid: Weak Cryptography and Insecure Password StorageEPSS 0.3%CVE-2023-41137HIGHSymmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client andEPSS 0.3%CVE-2026-7018MEDIUMDatavane Datavines JWT Token TokenManager.java hard-coded keyEPSS 0.3%CVE-2026-22906CRITICALHardcoded Key Allows Credential DisclosureEPSS 0.3%CVE-2024-45837MEDIUMUse of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthentEPSS 0.3%CVE-2026-28742CRITICALNaxclow IoT Platform Use of hard-coded cryptographic keyEPSS 0.3%CVE-2026-52727HIGHlxc-ci: Pacman keyring stored in archlinux image with a private keyEPSS 0.3%CVE-2024-12078MEDIUMECOVACS lawnmowers and vacuums static BLE GATT encryption keyEPSS 0.3%CVE-2026-7306MEDIUMXuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded keyEPSS 0.3%CVE-2026-54833HIGHWordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerabilityEPSS 0.3%CVE-2025-15108MEDIUMPandaXGO PandaX JWT Secret config.yml hard-coded keyEPSS 0.3%CVE-2025-46582HIGHPrivate Key Disclosure Vulnerability in ZTE ZXMP M721 ProductEPSS 0.3%CVE-2020-25234—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). TEPSS 0.3%CVE-2024-13842MEDIUMA hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticatEPSS 0.3%CVE-2026-78481MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2025-52373MEDIUMUse of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in databaseEPSS 0.3%CVE-2026-18754CRITICALHardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)EPSS 0.3%CVE-2025-66454MEDIUMArcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsEPSS 0.3%CVE-2026-18753CRITICALHardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)EPSS 0.3%