Common Weakness Enumeration
CWE-321
AllowedUse of Hard-coded Cryptographic Key
Abstraction: Variant · Status: Draft
The product uses a hard-coded, unchangeable cryptographic key.
682 vulnerabilities reference this CWE, most recent first.
GHSA-RJRP-832P-5V8P
Vulnerability from github – Published: 2023-06-27 03:30 – Updated: 2024-04-04 05:11
VLAI
Details
The User Registration plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-3371"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-27T02:15:09Z",
"severity": "HIGH"
},
"details": "The User Registration plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the \u0027lock_content_form_handler\u0027 and \u0027display_password_form\u0027 function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.",
"id": "GHSA-rjrp-832p-5v8p",
"modified": "2024-04-04T05:11:46Z",
"published": "2023-06-27T03:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3371"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/EmbedPress/Includes/Classes/Helper.php#L231"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/EmbedPress/Includes/Classes/Helper.php#L278"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/embedpress/tags/3.7.3/Gutenberg/block-backend/block-embedpress.php#L30"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2930523/embedpress#file10"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2930523/embedpress#file28"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1033b4d-82a0-4484-aebf-f35d6a2a9a13?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RPCG-4HQJ-WFV3
Vulnerability from github – Published: 2026-10-03 00:31 – Updated: 2026-10-03 00:31
VLAI
Details
Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, and can then decrypt the stored credentials of any specific installation to which the attacker separately obtains the encrypted configuration file.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-94591"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-02T22:16:56Z",
"severity": "HIGH"
},
"details": "Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, and can then decrypt the stored credentials of any specific installation to which the attacker separately obtains the encrypted configuration file.",
"id": "GHSA-rpcg-4hqj-wfv3",
"modified": "2026-10-03T00:31:13Z",
"published": "2026-10-03T00:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94591"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RPW3-CCP2-4V8W
Vulnerability from github – Published: 2026-10-18 12:30 – Updated: 2026-10-18 12:30
VLAI
Details
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-112014"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T12:17:14Z",
"severity": "MODERATE"
},
"details": "LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant \u0027lobsterai-APP\u0027. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.",
"id": "GHSA-rpw3-ccp2-4v8w",
"modified": "2026-10-18T12:30:29Z",
"published": "2026-10-18T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112014"
},
{
"type": "WEB",
"url": "https://github.com/netease-youdao/LobsterAI/issues/2851"
},
{
"type": "WEB",
"url": "https://github.com/netease-youdao/LobsterAI/commit/1eb28c40d7e42d6cbade07874e6f6c068b6a9a64"
},
{
"type": "WEB",
"url": "https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/components/Settings.tsx#L4324-L4331"
},
{
"type": "WEB",
"url": "https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constants/app.ts#L4"
},
{
"type": "WEB",
"url": "https://github.com/netease-youdao/LobsterAI/releases/tag/2026.10.16"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/lobsterai-before-2026.10.16-hardcoded-password-in-provider-api-key-export"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RQ87-W7PV-64X4
Vulnerability from github – Published: 2026-09-14 18:31 – Updated: 2026-09-14 18:31
VLAI
Details
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-90945"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T18:20:29Z",
"severity": "CRITICAL"
},
"details": "Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.",
"id": "GHSA-rq87-w7pv-64x4",
"modified": "2026-09-14T18:31:28Z",
"published": "2026-09-14T18:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90945"
},
{
"type": "WEB",
"url": "https://github.com/crawlab-team/crawlab/issues/1622"
},
{
"type": "WEB",
"url": "https://github.com/crawlab-team/crawlab"
},
{
"type": "WEB",
"url": "https://github.com/crawlab-team/crawlab-core/blob/main/user/service.go"
},
{
"type": "WEB",
"url": "https://github.com/crawlab-team/crawlab/blob/0485310def8b4f31ea20997846a8d5e7dfc681e5/core/user/service_v2.go"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/crawlab-through-0.6.3-authentication-bypass-via-hard-coded-jwt-secret"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RVV9-GRWC-5C44
Vulnerability from github – Published: 2025-08-04 18:30 – Updated: 2025-11-03 21:34
VLAI
Details
RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key.
Severity
9.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-44963"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-04T17:15:30Z",
"severity": "CRITICAL"
},
"details": "RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key.",
"id": "GHSA-rvv9-grwc-5c44",
"modified": "2025-11-03T21:34:19Z",
"published": "2025-08-04T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44963"
},
{
"type": "WEB",
"url": "https://claroty.com/team82/disclosure-dashboard/cve-2025-44963"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/613753"
},
{
"type": "WEB",
"url": "https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/613753"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RWHW-R234-9P3M
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2022-05-13 01:13
VLAI
Details
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2018-10896"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-01T17:29:00Z",
"severity": "HIGH"
},
"details": "The default cloud-init configuration, in cloud-init 0.6.2 and newer, included \"ssh_deletekeys: 0\", disabling cloud-init\u0027s deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.",
"id": "GHSA-rwhw-r234-9p3m",
"modified": "2022-05-13T01:13:59Z",
"published": "2022-05-13T01:13:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10896"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:3050"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:3644"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:3898"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2018-10896"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/cloud-init/+bug/1781094"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1574338"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1598831"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RX74-P2RX-RWPQ
Vulnerability from github – Published: 2025-11-25 06:33 – Updated: 2025-11-25 06:33
VLAI
Details
"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-64304"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-25T05:16:12Z",
"severity": "MODERATE"
},
"details": "\"FOD\" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.",
"id": "GHSA-rx74-p2rx-rwpq",
"modified": "2025-11-25T06:33:12Z",
"published": "2025-11-25T06:33:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64304"
},
{
"type": "WEB",
"url": "https://help.fod.fujitv.co.jp/hc/ja/articles/48337068747033"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN63368617"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V23F-Q7R3-X5CJ
Vulnerability from github – Published: 2022-05-24 16:56 – Updated: 2023-03-01 03:30
VLAI
Details
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-10990"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-23T16:15:00Z",
"severity": "MODERATE"
},
"details": "Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.",
"id": "GHSA-v23f-q7r3-x5cj",
"modified": "2023-03-01T03:30:29Z",
"published": "2022-05-24T16:56:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10990"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-248-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V3WH-X9P9-RCRQ
Vulnerability from github – Published: 2026-10-14 09:31 – Updated: 2026-10-14 09:31
VLAI
Details
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-107171"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T08:17:04Z",
"severity": "MODERATE"
},
"details": "An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.",
"id": "GHSA-v3wh-x9p9-rcrq",
"modified": "2026-10-14T09:31:34Z",
"published": "2026-10-14T09:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107171"
},
{
"type": "WEB",
"url": "https://support.trellix.com/s/article/000015866"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V536-8HRH-RXX4
Vulnerability from github – Published: 2025-09-30 12:30 – Updated: 2025-09-30 12:30
VLAI
Details
The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-8625"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-30T11:37:46Z",
"severity": "CRITICAL"
},
"details": "The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.",
"id": "GHSA-v536-8hrh-rxx4",
"modified": "2025-09-30T12:30:52Z",
"published": "2025-09-30T12:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8625"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/copypress-rest-api/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3045c9e5-4095-48e5-8d9d-16a091e69d54?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
No CAPEC attack patterns related to this CWE.