Falhas do tipo CWE-321

427 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-54807CRITICALDover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2024-1920MEDIUMosuuu LightPicture TokenVerify.php handle hard-coded keyEPSS 0.7%CVE-2025-34217CRITICALVasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH KeyEPSS 0.7%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2025-34256CRITICALAdvantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication BypassEPSS 0.7%CVE-2024-6890CRITICALJournyx Unauthenticated Password Reset BruteforceEPSS 0.7%CVE-2025-27674CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.EPSS 0.7%CVE-2023-3404MEDIUMProfileGrid <= 5.5.0 - Hardcoded Encryption KeyEPSS 0.7%CVE-2026-28326HIGHSolarWinds Access Rights Manager Unauthenticated Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-44318MEDIUMAffected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could alloEPSS 0.7%CVE-2026-54363CRITICALCentreStack < 17.5 Hardcoded Key Token Forgery RCEEPSS 0.7%CVE-2022-26020MEDIUMAn information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A speEPSS 0.7%CVE-2024-30407CRITICAL[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacksEPSS 0.7%CVE-2025-15627MEDIUMHardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol AuthenticationEPSS 0.7%CVE-2025-11899CRITICALFlowring Technology｜Agentflow - Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2025-59407CRITICALThe Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow LicensEPSS 0.7%CVE-2026-62241CRITICALclawvet < 0.7.5 Hard-coded JWT Secret Session ForgeryEPSS 0.7%CVE-2022-2660CRITICALDelta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allowEPSS 0.7%CVE-2026-56271CRITICALFlowise - Weak Default JWT Secrets in Authentication MiddlewareEPSS 0.7%CVE-2018-3825—In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper accesEPSS 0.7%