Falhas do tipo CWE-798

943 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2026-61684HIGHFastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')EPSS 0.5%CVE-2025-67418CRITICALClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administratEPSS 0.5%CVE-2024-53357HIGHMultiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low prEPSS 0.5%CVE-2022-47617HIGHHitron Technologies Inc. CODA-5310 - Hard-coded Cryptographic KeyEPSS 0.5%CVE-2025-67304CRITICALIn Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In thEPSS 0.5%CVE-2023-46943CRITICALAn issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcodEPSS 0.5%CVE-2024-25731HIGHThe Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a EPSS 0.5%CVE-2026-1221CRITICALBROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded CredentialsEPSS 0.5%CVE-2023-2306CRITICALQognify NiceVision Use of Hard-coded CredentialsEPSS 0.5%CVE-2026-4404CRITICALUse of hard coded credentials in GoHarbor HarborEPSS 0.5%CVE-2026-46386CRITICALOpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`EPSS 0.5%CVE-2024-8448HIGHPLANET Technology switch devices - Remote privilege escalation using hard-coded credentialsEPSS 0.5%CVE-2024-53484HIGHEver Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key.EPSS 0.5%CVE-2025-57434HIGHCreacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants accesEPSS 0.5%CVE-2026-29119HIGHHardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite ReceiverEPSS 0.5%CVE-2026-28777CRITICALHardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite ReceiverEPSS 0.5%CVE-2024-23726HIGHUbee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote attacker (in proximEPSS 0.5%CVE-2026-47846CRITICALBitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configEPSS 0.5%CVE-2025-34196CRITICALVasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded PasswordEPSS 0.5%CVE-2026-11414CRITICALUnauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path TraversalEPSS 0.5%