Falhas do tipo CWE-321

361 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2026-8739MEDIUMSanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded keyEPSS 0.3%CVE-2025-55449HIGHAstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.EPSS 0.3%CVE-2023-38535MEDIUMUse of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could EPSS 0.3%CVE-2024-13773HIGHCivi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information ExposureEPSS 0.3%CVE-2025-58426MEDIUMdesknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applicatioEPSS 0.3%CVE-2026-4588MEDIUMkalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded keyEPSS 0.3%CVE-2026-84483MEDIUMWWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.phpEPSS 0.3%CVE-2025-58069MEDIUMAutomationDirect CLICK PLUS Use of Hard-coded Cryptographic KeyEPSS 0.3%CVE-2026-17468MEDIUMIBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionEPSS 0.3%CVE-2026-15469HIGHHard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800EPSS 0.3%CVE-2025-1099HIGHInformation Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi CameraEPSS 0.3%CVE-2026-79551HIGHTenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.EPSS 0.3%CVE-2025-24525HIGHKeysight Ixia Vision Product Family Use of Hard-coded Cryptographic KeyEPSS 0.3%CVE-2025-6074MEDIUMAuthentication Bypass to the MQTT configuration Web InterfaceEPSS 0.3%CVE-2025-30234HIGHSmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a DebEPSS 0.3%CVE-2025-10080LOWrunning-elephant Datart API AESUtil.java getTokensecret hard-coded keyEPSS 0.3%CVE-2026-5622MEDIUMhcengineering Huly Platform JWT Token token.ts hard-coded keyEPSS 0.3%CVE-2020-25688—A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certifEPSS 0.3%CVE-2026-76258MEDIUMUse of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure GatewayEPSS 0.2%CVE-2025-54471MEDIUMNeuVector is shipping cryptographic material into its binaryEPSS 0.2%