Falhas do tipo CWE-321

360 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-54807CRITICALDover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2024-6890CRITICALJournyx Unauthenticated Password Reset BruteforceEPSS 0.7%CVE-2023-3404MEDIUMProfileGrid <= 5.5.0 - Hardcoded Encryption KeyEPSS 0.7%CVE-2025-27674CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.EPSS 0.7%CVE-2025-34256CRITICALAdvantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication BypassEPSS 0.7%CVE-2023-44318MEDIUMAffected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could alloEPSS 0.7%CVE-2024-30407CRITICAL[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacksEPSS 0.7%CVE-2025-11899CRITICALFlowring Technology｜Agentflow - Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2025-59407CRITICALThe Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow LicensEPSS 0.7%CVE-2022-26020MEDIUMAn information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A speEPSS 0.7%CVE-2026-56271CRITICALFlowise - Weak Default JWT Secrets in Authentication MiddlewareEPSS 0.7%CVE-2018-3825—In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper accesEPSS 0.7%CVE-2020-25229—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The implemented encryption for communicatioEPSS 0.6%CVE-2025-44963CRITICALRUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain sEPSS 0.6%CVE-2026-47410CRITICALpraisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unsetEPSS 0.6%CVE-2019-7594MEDIUMMetasys use of hardcoded RC2 keyEPSS 0.6%CVE-2024-46612CRITICALIceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.EPSS 0.6%CVE-2023-2158CRITICALImpersonation through User-Controlled TokenEPSS 0.6%CVE-2025-15107MEDIUMactiontech sqle JWT Secret jwt.go hard-coded keyEPSS 0.6%CVE-2022-2660CRITICALDelta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allowEPSS 0.6%