Skip to content
OpenAdvisories
High · 8.5 CVE-2026-11347 EUVD-2026-34811GHSA-gg86-h3jm-9m46

Hardcoded Cryptographic Keys and Weak IV Generation in linqi

Published Jun 5, 2026 · Updated Jun 5, 2026 · Assigned by linqi

Description

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.

Affected products

VendorProductAffectedFixed
linqi linqi ≤ 1.4.8.5 —

References