Use of Hard-coded Cryptographic Key
CWE-321
The product uses a hard-coded, unchangeable cryptographic key.
We track 210 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Prevention schemes mirror that of hard-coded password storage.
Latest Use of Hard-coded Cryptographic Key vulnerabilities
- 9.8 Critical severity
NextScan: Use of Hard-coded Cryptographic Key
NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super
- 9.8 Critical severity
astro-blocks: Use of Hard-coded Cryptographic Key
AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the
- 7.5 High severity
GV-Face: Use of Hard-coded Cryptographic Key
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
- 9.8 Critical severity
Asp.Net-Core-Inventory-Order-Management-System: Use of Hard-coded Cryptographic Key
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge toke
- 9.8 Critical severity
kubero: Use of Hard-coded Cryptographic Key
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary
- 8.0 High severity
Infantia: Use of Hard-coded Cryptographic Key
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
- 8.7 High severity
API Connect: Use of Hard-coded Cryptographic Key
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
- 9.8 Critical severity
Apache OFBiz: Use of Hard-coded Cryptographic Key
Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default s
- 7.8 High severity
Foglight for Databases: Use of Hard-coded Cryptographic Key
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obt
- 9.8 Critical severity
AJ-Report: Use of Hard-coded Cryptographic Key
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoade
- 9.8 Critical severity
ng-antd-admin: Use of Hard-coded Cryptographic Key
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication
- 9.8 Critical severity
OpenDeepWiki: Use of Hard-coded Cryptographic Key
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin
- 8.7 High severity
HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v
- 8.7 High severity
HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v
- 9.8 Critical severity
PowerProtect Data Domain: Use of Hard-coded Cryptographic Key
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded
- 9.8 Critical severity
nest-admin: Use of Hard-coded Cryptographic Key
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtSt
- 7.7 High severity
OnCell G3150A-LTE Series: Use of Hard-coded Cryptographic Key
A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared cryptographic key material and use it to impersonate affected devices that have not regenerate
- 8.1 High severity
kener: Use of Hard-coded Cryptographic Key
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrato
- 8.5 High severity
Kantech Entrapass: Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.
- 8.1 High severity
TTLock: Use of Hard-coded Cryptographic Key
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers ca
- 8.7 High severity
Agentic AI Call Centre: Use of Hard-coded Cryptographic Key
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript fi
- 8.8 High severity
Splunk Enterprise: Use of Hard-coded Cryptographic Key
In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk E
- 7.5 High severity
Guardium Data Protection: Use of Hard-coded Cryptographic Key
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
- 9.8 Critical severity
databuff: Use of Hard-coded Cryptographic Key
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future exp
- 9.8 Critical severity
simple-admin-core: Use of Hard-coded Cryptographic Key
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public s
- 8.8 High severity
FastapiAdmin: Use of Hard-coded Cryptographic Key
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoin
- 8.1 High severity
StaffDeck: Use of Hard-coded Cryptographic Key
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin'
- 8.6 High severity
ZKEACMS: Use of Hard-coded Cryptographic Key
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set
- 7.5 High severity
netdisk-fast-download: Use of Hard-coded Cryptographic Key
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decr
- 8.6 High severity
AIG-302 Series: Use of Hard-coded Cryptographic Key
A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidential
- 7.8 High severity
FirmwareUpdater: Use of Hard-coded Cryptographic Key
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
- 9.1 Critical severity
Remot Ops Agent: Use of Hard-coded Cryptographic Key
When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the defaul
- 7.1 High severity
seaweedfs: Use of Hard-coded Cryptographic Key
SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key.
- 9.8 Critical severity
vlife: Use of Hard-coded Cryptographic Key
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain sup
- 8.6 High severity
openUBMC: Use of Hard-coded Cryptographic Key
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still ca
- 9.8 Critical severity
mcp-context-forge: Improper Authentication
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform adm
- 7.5 High severity
MarkLogic Server: Use of Hard-coded Cryptographic Key
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge t
- 7.3 High severity
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206.
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is c
- 9.1 Critical severity
BotSharp: Use of Hard-coded Cryptographic Key
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and
- 8.8 High severity
Brocade Active Support Connectivity Gateway: Use of Hard-coded Cryptographic Key
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.