Falhas do tipo CWE-321

425 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-14651MEDIUMMartialBE one-hub docker-compose.yml hard-coded keyEPSS 0.4%CVE-2026-45433HIGHHardcoded Cryptographic Key Vulnerability in GX Earth ONT ModelsEPSS 0.3%CVE-2026-78481MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2023-41137HIGHSymmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client andEPSS 0.3%CVE-2024-12078MEDIUMECOVACS lawnmowers and vacuums static BLE GATT encryption keyEPSS 0.3%CVE-2025-46582HIGHPrivate Key Disclosure Vulnerability in ZTE ZXMP M721 ProductEPSS 0.3%CVE-2026-76258MEDIUMUse of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure GatewayEPSS 0.3%CVE-2026-7018MEDIUMDatavane Datavines JWT Token TokenManager.java hard-coded keyEPSS 0.3%CVE-2026-18411HIGHUse of hard-coded cryptographic key in Acrisure KARR BT and DR-100EPSS 0.3%CVE-2025-66454MEDIUMArcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsEPSS 0.3%CVE-2024-45837MEDIUMUse of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthentEPSS 0.3%CVE-2026-28742CRITICALNaxclow IoT Platform Use of hard-coded cryptographic keyEPSS 0.3%CVE-2021-32086CRITICALAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt sEPSS 0.3%CVE-2025-13877MEDIUMnocobase JWT Service jwt-service.ts hard-coded keyEPSS 0.3%CVE-2026-7306MEDIUMXuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded keyEPSS 0.3%CVE-2026-18330MEDIUMHardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7EPSS 0.3%CVE-2025-13948MEDIUMopsre go-ldap-admin JWT docker-compose.yaml hard-coded keyEPSS 0.3%CVE-2026-54833HIGHWordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerabilityEPSS 0.3%CVE-2025-15108MEDIUMPandaXGO PandaX JWT Secret config.yml hard-coded keyEPSS 0.3%CVE-2020-25234—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). TEPSS 0.3%