CWE-798— Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.— MITRE CWE catalog

1,950 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-798page 31 of 39

CVE-2023-45226HIGHCVSS 7.4EG 7.4
2023-10-10
The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server …
CVE-2023-37426HIGHCVSS 7.4EG 7.4
2023-08-22
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature …
CVE-2022-31460HIGHCVSS 7.4EG 7.4
2022-06-02
Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.
CVE-2022-24860HIGHCVSS 7.4EG 7.4
2022-04-20
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in…
CVE-2021-45521HIGHCVSS 7.4EG 7.4
2021-12-26
Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10.
CVE-2018-18979HIGHCVSS 7.4EG 7.4
2019-05-06
An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction of the initialization vector is necessary for deciphering communications betwee…
CVE-2018-18978HIGHCVSS 7.4EG 7.4
2019-05-06
An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for deciphering communications between this applica…
CVE-2018-10328HIGHCVSS 7.4EG 7.4
2018-04-24
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.
CVE-2026-110667HIGHCVSS 7.3EG 7.3
2026-10-14
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can…
CVE-2026-105147HIGHCVSS 7.3EG 7.3
2026-10-04
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credential…
CVE-2026-101052HIGHCVSS 7.3EG 7.3
2026-09-28
A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input …
CVE-2026-93970HIGHCVSS 7.3EG 7.3
2026-09-20
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. T…
CVE-2026-93969HIGHCVSS 7.3EG 7.3
2026-09-20
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be car…
CVE-2026-90509HIGHCVSS 7.3EG 7.3
2026-09-13
A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The at…
CVE-2026-86673HIGHCVSS 7.3EG 7.3
2026-09-08
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connecti…
CVE-2026-86276HIGHCVSS 7.3EG 7.3
2026-09-07
A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack c…
CVE-2026-82808HIGHCVSS 7.3EG 7.3
2026-08-31
A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation…
CVE-2026-78062HIGHCVSS 7.3EG 7.3
2026-08-23
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to…
CVE-2026-6374HIGHCVSS 7.3EG 7.3
2026-08-10
Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.
CVE-2026-8876HIGHCVSS 7.3EG 7.3
2026-06-03
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.
CVE-2026-36538HIGHCVSS 7.3EG 7.3
2026-05-27
Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account is set to the trivially weak value root, allowing an attacker with access to the device to authentic…
CVE-2026-8032HIGHCVSS 7.3EG 7.3
2026-05-06
A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of the file /cdemos/echs/priv/echs.js. This manipulation of the argument ADMIN_KEY causes hard-coded credentials. The att…
CVE-2026-7579HIGHCVSS 7.3EG 7.3
2026-05-01
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded creden…
CVE-2026-6574HIGHCVSS 7.3EG 7.3
2026-04-19
A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the component API Upload Endpoint. Such manipulation of the argument key leads to hard-coded…
CVE-2025-15605HIGHCVSS 7.3EG 7.3
2026-03-23
A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, …
CVE-2026-29023HIGHCVSS 7.3EG 7.3
2026-03-09
Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the …
CVE-2025-13252HIGHCVSS 7.3EG 7.3
2025-11-16
A vulnerability was found in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Affected by this issue is some unknown functionality of the component RSA/OAuth2/Database. The manipulation results in hard-code…
CVE-2025-32889HIGHCVSS 7.3EG 7.3
2025-05-01
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used for sending SMS through a goTenna server is hardcoded in the app.
CVE-2025-32888HIGHCVSS 7.3EG 7.3
2025-05-01
An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token used for sending SMS through a goTenna server is hardcoded in the app.
CVE-2025-2322HIGHCVSS 7.3EG 7.3
2025-03-15
A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java.…
CVE-2024-13773HIGHCVSS 7.3EG 7.3
2025-03-14
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenti…
CVE-2024-8893HIGHCVSS 7.3EG 7.3
2025-02-14
Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi.This issue affects GW1500‑XS: 1.1.2.…
CVE-2024-11630HIGHCVSS 7.3EG 7.3
2024-11-22
A vulnerability has been found in E-Lins H685, H685f, H700, H720, H750, H820, H820Q, H820Q0 and H900 up to 3.2 and classified as critical. This vulnerability affects unknown code of the component OEM Backend. The manipulation leads to hard…
CVE-2024-8005HIGHCVSS 7.3EG 7.3
2024-08-20
A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded cred…
CVE-2024-29063HIGHCVSS 7.3EG 7.3
2024-04-09
Azure AI Search Information Disclosure Vulnerability
CVE-2023-2637HIGHCVSS 7.3EG 7.3
2023-06-13
Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lead to privilege escalation. This vulnerability may allow a local, authenticate…
CVE-2022-26672HIGHCVSS 7.3EG 7.3
2022-04-22
ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a…
CVE-2022-26671HIGHCVSS 7.3EG 7.3
2022-04-07
Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to…
CVE-2021-23233HIGHCVSS 7.3EG 7.3
2022-01-21
Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform…
CVE-2021-32521HIGHCVSS 7.3EG 7.3
2021-07-07
Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
CVE-2021-33540HIGHCVSS 7.3EG 7.3
2021-06-25
In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.
CVE-2021-31477HIGHCVSS 7.3EG 7.3
2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesy…
CVE-2021-21979HIGHCVSS 7.3EG 7.3
2021-03-03
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker…
CVE-2019-7279HIGHCVSS 7.3EG 7.3
2019-07-01
Optergy Proton/Enterprise devices have Hard-coded Credentials.
CVE-2018-15360HIGHCVSS 7.3EG 7.3
2018-08-17
An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0.
CVE-2018-10966HIGHCVSS 7.3EG 7.3
2018-06-05
An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wis…
CVE-2018-10813HIGHCVSS 7.3EG 7.3
2018-06-05
In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using…
CVE-2017-12726HIGHCVSS 7.3EG 7.3
2018-02-15
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to all…
CVE-2017-9956HIGHCVSS 7.3EG 7.3
2017-09-26
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cooki…
CVE-2022-30622HIGHCVSS 5.3EG 7.3
2022-07-17
Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sys_username_passwd.cmd - The server loads the request clearly by …

Map vulnerabilities like CWE-798 to your infrastructure

EchelonGraph correlates every CVE — across CWE-798 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →