Falhas do tipo CWE-321

423 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2024-35344CRITICALCertain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B85EPSS 0.4%CVE-2026-119597CRITICALOpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token ForgeryEPSS 0.4%CVE-2026-85153CRITICALInformation Disclosure Vulnerability in Schmooze dating mobile ApplicationEPSS 0.4%CVE-2026-110474HIGHHardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre applicationEPSS 0.4%CVE-2024-33849MEDIUMci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.EPSS 0.4%CVE-2026-3963MEDIUMperfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded keyEPSS 0.4%CVE-2024-42418HIGHAvtec Outpost Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2025-35052MEDIUMNewforma Info Exchange (NIX) shared hard-coded secret keyEPSS 0.4%CVE-2026-100413HIGHSeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deploymentsEPSS 0.4%CVE-2025-45746MEDIUMIn ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service coEPSS 0.4%CVE-2026-111642HIGHFastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege EscalationEPSS 0.4%CVE-2025-22463HIGHA hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environmenEPSS 0.4%CVE-2024-52881HIGHAn issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is EPSS 0.4%CVE-2026-17468MEDIUMIBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionEPSS 0.4%CVE-2026-22906CRITICALHardcoded Key Allows Credential DisclosureEPSS 0.4%CVE-2025-52373MEDIUMUse of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in databaseEPSS 0.4%CVE-2026-76298HIGHUse of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk EnterpriseEPSS 0.4%CVE-2026-14932MEDIUMUnauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChartEPSS 0.4%CVE-2018-10896MEDIUMThe default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh hoEPSS 0.4%CVE-2026-76847HIGHact 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 BackendEPSS 0.4%