Falhas do tipo CWE-321

421 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-67305CRITICALIn RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical aEPSS 0.6%CVE-2023-48392CRITICALKaifa Technology WebITR - Hard-coded Cryptographic KeyEPSS 0.6%CVE-2025-62581CRITICALDIAView - Authentication Bypass VulnerabilityEPSS 0.6%CVE-2021-38461HIGHAUVESY VersiondogEPSS 0.5%CVE-2024-58134HIGHMojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by defaultEPSS 0.5%CVE-2026-120209CRITICALAJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-TokenEPSS 0.5%CVE-2025-8759MEDIUMTRENDnet TN-200 Lighttpd hard-coded keyEPSS 0.5%CVE-2023-3371MEDIUMEmbedPress <= 3.7.3 - Sensitive Information ExposureEPSS 0.5%CVE-2026-103055HIGHAiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT SecretEPSS 0.5%CVE-2025-65998HIGHApache Syncope: Default AES key used for internal password encryptionEPSS 0.5%CVE-2025-15016CRITICALRagic｜Enterprise Cloud Database - Hard-coded Cryptographic KeyEPSS 0.5%CVE-2026-87929CRITICALMaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption KeyEPSS 0.5%CVE-2025-15105MEDIUMgetmaxun auth.ts hard-coded keyEPSS 0.5%CVE-2025-41702CRITICALegOS WebGUI Hard-Coded JWT Secret Enables Authentication BypassEPSS 0.5%CVE-2025-11609MEDIUMcode-projects Hospital Management System express-session hard-coded keyEPSS 0.5%CVE-2019-19752CRITICALnvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identificationEPSS 0.5%CVE-2026-78225CRITICALWärtsilä FOS-Onboard Use of Hard-coded Cryptographic KeyEPSS 0.5%CVE-2026-61737CRITICALng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-adminEPSS 0.5%CVE-2026-82891HIGHIBM Guardium Data Protection is affected by a security vulnerabilityEPSS 0.5%CVE-2025-30095CRITICALVyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear privateEPSS 0.5%