Weakness (CWE)
CWE-321: Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
How to prevent it (1 mitigation)
-
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
Source: MITRE CWE-321
429 results · Feed
-
Medium 6.5
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
-
Medium 6.0
Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a re…
-
Unscored —
Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access
Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default …
-
High 7.8
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first ob…
-
Low 2.4
Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthe…
-
Critical 9.8CVE-2026-120209 Public exploit
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoad…
-
Critical 9.8
ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authenticatio…
-
High 7.3
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A l…
-
Critical 9.8
OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin…
-
High 8.7
Hard-coded Cryptographic Key #2
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the …
-
High 8.7
Hard-coded Cryptographic Key #1
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the …
-
Critical 9.8
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through …
-
Medium 6.9
Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7
A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who…
-
Critical 9.8
nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtS…
-
High 7.7
Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerat…
-
High 8.1
Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrat…
-
High 7.3
OctoPrint Flask Secret Key hard-coded key
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading…
-
High 8.5
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto At…
-
High 8.1
TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers c…
-
High 8.7
Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript f…
-
High 8.8
Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk …
-
Medium 5.9
Hardcoded AES encryption key in Archer C6
A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext …
-
High 8.1
IBM Guardium Data Protection is affected by a security vulnerability
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
-
Medium 5.3
MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to us…
-
Medium 5.5
LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2…
-
Medium 6.5
data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasour…
-
Critical 9.8
DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future ex…
-
Critical 9.8
Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public …
-
High 8.8
FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoi…
-
High 8.1
OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin'…
-
High 8.6
ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim se…
-
High 7.5
netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and dec…
-
High 8.6
Shared Hard-coded Root CA Private Key
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentia…
-
Medium 5.9
go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoi…
-
High 7.8
EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
-
Critical 9.1
Token Signing Key Allows Unauthenticated Administrative Access
When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the defau…
-
High 7.0
SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments
SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key.…
-
Critical 9.8
vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain su…
-
Medium 6.9
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decrypt…
-
Low 3.7
Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signat…