Use of Hard-coded Cryptographic Key
CWE-321
The product uses a hard-coded, unchangeable cryptographic key.
We track 210 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Prevention schemes mirror that of hard-coded password storage.
Latest Use of Hard-coded Cryptographic Key vulnerabilities
- 8.5 High severity
ADVMS: Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10.
- 9.3 Critical severity
Schmooze dating mobile Application: Use of Hard-coded Cryptographic Key
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and e
- 7.3 High severity
A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12.
A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-code
- 8.4 High severity
Armatura One: Use of Hard-coded Cryptographic Key
Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and ar
- 9.3 Critical severity
EasyIO FS32: Use of Hard-coded Cryptographic Key
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.
- 9.8 Critical severity
Hitachi Coding Software Suite: Use of Hard-coded Cryptographic Key
Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects H
- 7.5 High severity
HELO Plus: Use of Hard-coded Cryptographic Key
AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers
- 7.5 High severity
AiSOC: Use of Hard-coded Cryptographic Key
AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitr
- 8.1 High severity
Financial Transaction Manager (FTM) for RedHat…: Use of Hard-coded Cryptographic Key
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.
- 10.0 Critical severity
ManageEngine Applications Manager: Use of Hard-coded Cryptographic Key
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service accou
- 7.5 High severity
Financial Transaction Manager (FTM) for RedHat…: Use of Hard-coded Cryptographic Key
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.
- 7.2 High severity
lxc-ci: Use of Hard-coded Cryptographic Key
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to
- 8.8 High severity
Access Rights Manager: Use of Hard-coded Cryptographic Key
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
- 9.8 Critical severity
OpenManage Server Administrator Managed Node…: Use of Hard-coded Cryptographic Key
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- 9.8 Critical severity
Issabel Framework: Use of Hard-coded Cryptographic Key
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to f
- 9.8 Critical severity
crawlab: Use of Hard-coded Cryptographic Key
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code
- 8.3 High severity
A security vulnerability has been detected in dromara orion-visor up to 2.5.7.
A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/mod
- 9.8 Critical severity
MaxSite CMS: Use of Hard-coded Cryptographic Key
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_ses
- 9.1 Critical severity
cjose: Use of Hard-coded Cryptographic Key
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`
- 7.8 High severity
PerformanceTest: Use of Hard-coded Cryptographic Key
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes
- 9.8 Critical severity
WE1326: Improper Neutralization of Special Elements used in an OS Command
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1
- 7.7 High severity
Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6: Use of Hard-coded Cryptographic Key
The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for
- 8.8 High severity
act: Use of Hard-coded Cryptographic Key
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtif
- 7.8 High severity
Accessories and Display Manager: Use of Hard-coded Cryptographic Key
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.
- 8.4 High severity
ColdFusion 2025: Use of Hard-coded Cryptographic Key
is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation
- 7.9 High severity
SAP BusinessObjects Business Intelligence…: Use of Hard-coded Cryptographic Key
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt
- 8.5 High severity
HB810(US2) V1.0/1.6/2.0/2.6: Use of Hard-coded Cryptographic Key
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation
- 8.8 High severity
TeamDavid: Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherw
- 8.1 High severity
KARR BT: Use of Hard-coded Cryptographic Key
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, pot
- 9.1 Critical severity
HUMANIST Digital Human Resources: Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26
- 9.1 Critical severity
GV-AS1620 (GV-Cloud): Use of Hard-coded Cryptographic Key
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffi
- 9.1 Critical severity
GV-AS1620 (AS-Manager): Use of Hard-coded Cryptographic Key
The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffi
- 7.5 High severity
Omada Gateways: Use of Hard-coded Cryptographic Key
A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able
- 9.8 Critical severity
Zulip template: Use of Hard-coded Cryptographic Key
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
- 9.1 Critical severity
CentreStack: Use of Hard-coded Cryptographic Key
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt()
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Use of Hard-coded Cryptographic Key
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge
- 9.8 Critical severity
praisonai-platform: Use of Hard-coded Cryptographic Key
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET
- 9.1 Critical severity
clawvet: Missing Authentication for Critical Functionality
clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without aut
- 9.8 Critical severity
Flowise: Use of Hard-coded Cryptographic Key
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/ser
- 8.3 High severity
dataease: Use of Hard-coded Cryptographic Key
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-p