Falhas do tipo CWE-321

425 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2026-90510MEDIUMdromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded keyEPSS 0.5%CVE-2023-42492HIGH EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic KeyEPSS 0.5%CVE-2026-111347HIGHgo-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwdEPSS 0.5%CVE-2019-17098LOWUse of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge AppEPSS 0.5%CVE-2026-86241MEDIUMliufee FeehiCMS Cookie Validation main-local.php hard-coded keyEPSS 0.5%CVE-2025-3177LOWFastCMS JWT hard-coded keyEPSS 0.5%CVE-2026-111612HIGHnetdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuthEPSS 0.5%CVE-2022-34440HIGHDell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker withEPSS 0.5%CVE-2022-34441HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker witEPSS 0.5%CVE-2026-16504CRITICALVPS.org one-click Zulip template deployment instance contains multiple vulnerabilitiesEPSS 0.5%CVE-2014-125135MEDIUMOctoPrint Flask Secret Key hard-coded keyEPSS 0.5%CVE-2025-54947MEDIUMApache StreamPark: Use hard-coded key vulnerabilityEPSS 0.5%CVE-2026-108860CRITICALBotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing KeyEPSS 0.5%CVE-2026-86384CRITICALDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reEPSS 0.5%CVE-2024-41260HIGHA static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtaEPSS 0.5%CVE-2023-49256HIGHPredictable encryption passphrase used in publicly accessible configuration fileEPSS 0.5%CVE-2017-9649—A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, EPSS 0.5%CVE-2025-15005MEDIUMCouchCMS reCAPTCHA config.example.php hard-coded keyEPSS 0.5%CVE-2026-54218HIGHTeamDavid: Weak Cryptography and Insecure Password StorageEPSS 0.5%CVE-2026-110214MEDIUMSnowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File DownloadEPSS 0.5%