Use of Hard-coded Cryptographic Key
CWE-321
The product uses a hard-coded, unchangeable cryptographic key.
We track 210 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Prevention schemes mirror that of hard-coded password storage.
Latest Use of Hard-coded Cryptographic Key vulnerabilities
- 9.1 Critical severity
Sogexia: Use of Hard-coded Cryptographic Key
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file
- 8.1 High severity
A security vulnerability has been detected in PHPGurukul News Portal 1.0.
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . The attack may be p
- 7.7 High severity
ZXMP M721: Use of Hard-coded Cryptographic Key
A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security.
- 7.0 High severity
Deck Mate 2: Use of Hard-coded Cryptographic Key
Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update
- 8.1 High severity
Agentflow: Use of Hard-coded Cryptographic Key
Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first
- 8.1 High severity
A flaw has been found in code-projects Hospital Management System 1.0.
A flaw has been found in code-projects Hospital Management System 1.0. Affected is the function session of the component express-session. This manipulation of the argument secret with the input secret causes use of hard-coded cryptographic key . The attack can
- 8.1 High severity
A vulnerability was identified in CRMEB up to 5.6.1.
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to lau
- 9.8 Critical severity
Flock Safety: Use of Hard-coded Cryptographic Key
The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded pass
- 7.5 High severity
Ixia Vision Product Family: Use of Hard-coded Cryptographic Key
Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replace the TLS certificate that shipped with
- 9.8 Critical severity
Print Virtual Appliance Host: Use of Hard-coded Cryptographic Key
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded SSH public key in '~/.ssh/authorized_keys' and a sudoers rule granting the printerlogic_ssh group 'NO
- 9.8 Critical severity
Copypress Rest API: Use of Hard-coded Cryptographic Key
The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file typ
- 7.5 High severity
Print Virtual Appliance Host: Use of Hard-coded Cryptographic Key
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerlo
- 9.8 Critical severity
Print Virtual Appliance Host: Missing Authentication for Critical Functionality
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/upd
- 7.5 High severity
Cognos Controller: Use of Hard-coded Cryptographic Key
IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies.
- 9.8 Critical severity
ProGauge MagLink LX 4: Use of Hard-coded Cryptographic Key
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.
- 7.4 High severity
Control-M/Agent: Use of Hard-coded Cryptographic Key
Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key c
- 9.8 Critical severity
EG400Mk2-D11001-000101: Use of Hard-coded Cryptographic Key
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
- 9.8 Critical severity
Reolink: Use of Hard-coded Cryptographic Key
Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.
- 7.5 High severity
Enterprise SONiC OS: Use of Hard-coded Credentials
Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication.
- 8.1 High severity
Network Director: Use of Hard-coded Cryptographic Key
RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key.
- 7.3 High severity
Workspace Control: Use of Hard-coded Cryptographic Key
A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password.
- 8.1 High severity
PerfreeBlog: Use of Hard-coded Credentials
A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remote
- 7.7 High severity
iLabClient: Use of Hard-coded Cryptographic Key
itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to the database.
- 9.8 Critical severity
ZKBio CVSecurity: Use of Hard-coded Credentials
In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessi
- 8.1 High severity
Mojolicious: Use of Hard-coded Cryptographic Key
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who know
- 9.8 Critical severity
dpanel: Use of Hard-coded Cryptographic Key
Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine.
- 8.1 High severity
A vulnerability was found in FastCMS 0.1.5.
A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The comple
- 9.8 Critical severity
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Exploited
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey)
- 9.0 Critical severity
VyOS: Use of Hard-coded Cryptographic Key
VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH co
- 8.3 High severity
SmartOS: Use of Hard-coded Cryptographic Key
SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone image from 2024-07-26).
- 7.5 High severity
Civi - Job Board & Freelance Marketplace…: Use of Hard-coded Credentials
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to ex
- 8.8 High severity
MaxTime: Use of Hard-coded Cryptographic Key
A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.
- 7.7 High severity
FortiManager: Use of Hard-coded Cryptographic Key
A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0 all versions, 6.4 all versions may allow an attacker with JSON API access permissions to
- 7.0 High severity
Tapo C500 V1 Wi-Fi Camera: Use of Hard-coded Cryptographic Key
This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform
- 7.5 High severity
One Voice Operations Center: Use of Hard-coded Cryptographic Key
An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.
- 9.8 Critical severity
FortiSwitch: Use of Hard-coded Credentials
A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via cr
- 8.8 High severity
Unified SecOps Platform: Use of Hard-coded Credentials
Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authenticati
- 8.1 High severity
Cisco Digital Network Architecture Center (DNA…: Use of Hard-coded Cryptographic Key
A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An atta
- 9.8 Critical severity
Dragonfly2: Use of Hard-coded Credentials
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key"
- 8.8 High severity
Journyx (jtime): Use of Hard-coded Credentials
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.