Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1394: Use of Default Cryptographic Key

Base Incomplete

The product uses a default cryptographic key for potentially critical functionality.

How to prevent it (3 mitigations)

  1. Requirements

    Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

  2. Architecture and Design

    Force the administrator to change the credential upon installation.

  3. Installation, Operation

    The product administrator could change the defaults upon installation or during operation.

Source: MITRE CWE-1394

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-92777

    A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlock…

    Lenovo Tab M10 5G (TB360ZU) Tab Extreme (TB570ZU/TB570FU) Tab K9 (TB305XU)
  • Medium 6.5
    CVE-2026-111367

    BillionMail through 4.9 Forgeable JWTs via Default Signing Key

    BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens t…

    aaPanel BillionMail
  • Medium 5.9
    CVE-2026-107177

    Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens

    Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decryp…

    ExpressGateway express-gateway
  • Medium 6.3
    CVE-2026-54887

    DTLS server cookie bypass during startup window due to empty initial cookie secret

    Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 in…

    erlang OTP erlang erlang Debian Ubuntu
  • Medium 6.1
    CVE-2026-5039

    Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N

    TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit…

    TP-Link Systems TL-WL841N v13 Network devices
  • Medium 6.6
    CVE-2026-20709

    Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron…

  • Medium 5.5
    CVE-2025-1688

    System configuration password reset

    Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional…

    Milestone Systems XProtect VMS
  • Medium 4.3
    CVE-2025-26849

    There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be us…

    Docusnap Docusnap
  • Medium 5.0
    CVE-2024-11619

    macrozheng mall JWT Token default key

    A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The compl…

    macrozheng mall