CWE-321
AllowedUse of Hard-coded Cryptographic Key
Abstraction: Variant · Status: Draft
The product uses a hard-coded, unchangeable cryptographic key.
682 vulnerabilities reference this CWE, most recent first.
GHSA-8PJ9-C2GQ-JHW8
Vulnerability from github – Published: 2024-02-06 21:30 – Updated: 2024-04-29 12:30A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWT_KEY_ADMIN leads to use of hard-coded cryptographic key . The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252997 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2024-1258"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T21:15:08Z",
"severity": "LOW"
},
"details": "A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file api/config/params.php of the component API. The manipulation of the argument JWT_KEY_ADMIN leads to use of hard-coded cryptographic key\n . The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252997 was assigned to this vulnerability.",
"id": "GHSA-8pj9-c2gq-jhw8",
"modified": "2024-04-29T12:30:34Z",
"published": "2024-02-06T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1258"
},
{
"type": "WEB",
"url": "https://note.zhaoj.in/share/XblX1My7jNV7"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.252997"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.252997"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.277418"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8PX6-9GMX-37G4
Vulnerability from github – Published: 2025-08-22 18:31 – Updated: 2025-08-26 15:30Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.
{
"affected": [],
"aliases": [
"CVE-2025-55619"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-22T17:15:32Z",
"severity": "CRITICAL"
},
"details": "Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.",
"id": "GHSA-8px6-9gmx-37g4",
"modified": "2025-08-26T15:30:56Z",
"published": "2025-08-22T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25173"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55619"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/321.html"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/329.html"
},
{
"type": "WEB",
"url": "https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences"
},
{
"type": "WEB",
"url": "https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0"
},
{
"type": "WEB",
"url": "https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8RGX-FMM3-3QVV
Vulnerability from github – Published: 2025-02-12 15:31 – Updated: 2025-02-12 15:31A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2025-26340"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:33Z",
"severity": "HIGH"
},
"details": "A CWE-321 \"Use of Hard-coded Cryptographic Key\" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.",
"id": "GHSA-8rgx-fmm3-3qvv",
"modified": "2025-02-12T15:31:59Z",
"published": "2025-02-12T15:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26340"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26340"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8V4W-XW92-9W3Q
Vulnerability from github – Published: 2026-09-17 09:33 – Updated: 2026-09-17 09:33A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.
{
"affected": [],
"aliases": [
"CVE-2026-50606"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T08:17:01Z",
"severity": "LOW"
},
"details": "A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.",
"id": "GHSA-8v4w-xw92-9w3q",
"modified": "2026-09-17T09:33:01Z",
"published": "2026-09-17T09:33:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50606"
},
{
"type": "WEB",
"url": "https://community.acer.com/en/kb/articles/19873"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8VH6-M67F-4H33
Vulnerability from github – Published: 2025-03-31 15:30 – Updated: 2025-04-11 15:32VyOS 1.3 through 1.5 or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS, this is not the default configuration for the system SSH daemon, but is for the console service. To mitigate this, one can run "rm -f /etc/dropbear/key" and/or "rm -f /etc/dropbear-initramfs/key" and then dropbearkey -t rsa -s 4096 -f /etc/dropbear_rsa_host_key and reload the service or reboot the system before using Dropbear as the SSH daemon (this clears out all keys mistakenly built into the release image) or update to the latest version of VyOS 1.4 or 1.5. Note that this vulnerability is not unique to VyOS and may appear in any Debian-based Linux distribution that uses Dropbear in combination with live-build, which has a safeguard against this behavior in OpenSSH but no equivalent one for Dropbear.
{
"affected": [],
"aliases": [
"CVE-2025-30095"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T15:15:44Z",
"severity": "CRITICAL"
},
"details": "VyOS 1.3 through 1.5 or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS, this is not the default configuration for the system SSH daemon, but is for the console service. To mitigate this, one can run \"rm -f /etc/dropbear/*key*\" and/or \"rm -f /etc/dropbear-initramfs/*key*\" and then dropbearkey -t rsa -s 4096 -f /etc/dropbear_rsa_host_key and reload the service or reboot the system before using Dropbear as the SSH daemon (this clears out all keys mistakenly built into the release image) or update to the latest version of VyOS 1.4 or 1.5. Note that this vulnerability is not unique to VyOS and may appear in any Debian-based Linux distribution that uses Dropbear in combination with live-build, which has a safeguard against this behavior in OpenSSH but no equivalent one for Dropbear.",
"id": "GHSA-8vh6-m67f-4h33",
"modified": "2025-04-11T15:32:26Z",
"published": "2025-03-31T15:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30095"
},
{
"type": "WEB",
"url": "https://blog.vyos.io/vyos-project-march-2025-update"
},
{
"type": "WEB",
"url": "https://blog.vyos.io/vyos-stream-1.5-2025-q1"
},
{
"type": "WEB",
"url": "https://github.com/vyos"
},
{
"type": "WEB",
"url": "https://vyos.dev/T7217"
},
{
"type": "WEB",
"url": "https://vyos.net/get/stream/#1.5-2025-Q1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8X8H-HCQ8-JWWX
Vulnerability from github – Published: 2023-08-25 18:38 – Updated: 2026-05-19 16:06Impact
Hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.
Patches
Issue is patched in 0.17.1, and fixed in 0.18.6+.
If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users
If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.
Workarounds
If using 0.17.1, can just pull the latest docker image of backend and restart server.
References
Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gravitl/netmaker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/gravitl/netmaker"
},
"ranges": [
{
"events": [
{
"introduced": "0.18.0"
},
{
"fixed": "0.18.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-32077"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-25T18:38:18Z",
"nvd_published_at": "2023-08-24T22:15:08Z",
"severity": "HIGH"
},
"details": "### Impact \nHardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.\n\n### Patches\nIssue is patched in 0.17.1, and fixed in 0.18.6+. \n\nIf Users are using 0.17.1, they should run \"docker pull gravitl/netmaker:v0.17.1\" and \"docker-compose up -d\". This will switch them to the patched users\n\nIf users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.\n\n### Workarounds\nIf using 0.17.1, can just pull the latest docker image of backend and restart server.\n\n### References\nCredit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery",
"id": "GHSA-8x8h-hcq8-jwwx",
"modified": "2026-05-19T16:06:30Z",
"published": "2023-08-25T18:38:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32077"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/pull/2170"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657"
},
{
"type": "PACKAGE",
"url": "https://github.com/gravitl/netmaker"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Netmaker has Hardcoded DNS Secret Key"
}
GHSA-8XHF-8Q7J-9Q7Q
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
{
"affected": [],
"aliases": [
"CVE-2026-111692"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:52Z",
"severity": "CRITICAL"
},
"details": "DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.",
"id": "GHSA-8xhf-8q7j-9q7q",
"modified": "2026-10-16T18:34:52Z",
"published": "2026-10-16T18:34:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111692"
},
{
"type": "WEB",
"url": "https://github.com/databufflabs/databuff"
},
{
"type": "WEB",
"url": "https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/auth/JwtTokenService.java#L36-L60"
},
{
"type": "WEB",
"url": "https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/config/JwtProperties.java#L8-L15"
},
{
"type": "WEB",
"url": "https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/resources/application.yml#L54-L59"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/databuff-ai-apm-web-through-0.1.10-authentication-bypass-via-hardcoded-hmac-secret"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8XXP-5P6V-MJX3
Vulnerability from github – Published: 2026-10-16 00:31 – Updated: 2026-10-16 00:31go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
{
"affected": [],
"aliases": [
"CVE-2026-111347"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-15T22:19:32Z",
"severity": "HIGH"
},
"details": "go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.",
"id": "GHSA-8xxp-5p6v-mjx3",
"modified": "2026-10-16T00:31:57Z",
"published": "2026-10-16T00:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111347"
},
{
"type": "WEB",
"url": "https://github.com/opsre/go-ldap-admin"
},
{
"type": "WEB",
"url": "https://github.com/opsre/go-ldap-admin/blob/v0.6.2/config/config.go#L20-L24"
},
{
"type": "WEB",
"url": "https://github.com/opsre/go-ldap-admin/blob/v0.6.2/config/config.go#L76-L77"
},
{
"type": "WEB",
"url": "https://github.com/opsre/go-ldap-admin/blob/v0.6.2/logic/base_logic.go#L188-L199"
},
{
"type": "WEB",
"url": "https://github.com/opsre/go-ldap-admin/blob/v0.6.2/routes/base_routes.go#L50"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/go-ldap-admin-hardcoded-rsa-key-decrypt-oracle-and-unauth-password-reset"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/go-ldap-admin-through-0.6.2-hard-coded-rsa-private-key-via-base-decryptpwd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9288-5J8R-8W68
Vulnerability from github – Published: 2026-08-05 21:31 – Updated: 2026-08-05 21:31The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.
{
"affected": [],
"aliases": [
"CVE-2026-18411"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T21:16:57Z",
"severity": "HIGH"
},
"details": "The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.",
"id": "GHSA-9288-5j8r-8w68",
"modified": "2026-08-05T21:31:39Z",
"published": "2026-08-05T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18411"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-216-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9363-C6W4-4XC7
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
{
"affected": [],
"aliases": [
"CVE-2026-111612"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:40Z",
"severity": "HIGH"
},
"details": "netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users\u0027 cloud-drive cookies, tokens, or passwords.",
"id": "GHSA-9363-c6w4-4xc7",
"modified": "2026-10-16T18:34:42Z",
"published": "2026-10-16T18:34:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111612"
},
{
"type": "WEB",
"url": "https://github.com/qaiu/netdisk-fast-download"
},
{
"type": "WEB",
"url": "https://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/common/util/AuthParamCodec.java#L31"
},
{
"type": "WEB",
"url": "https://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/web/controller/ParserApi.java#L738-L752"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosure"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/netdisk-fast-download-through-0.4.8-credential-disclosure-via-v2-randomauth"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Prevention schemes mirror that of hard-coded password storage.
No CAPEC attack patterns related to this CWE.