CWE-321

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@dfinity/identity"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.20.0-beta.0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@dfinity/auth-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.20.0-beta.0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-1631"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321",
      "CWE-330"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-21T02:54:56Z",
    "nvd_published_at": "2024-02-21T03:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "## Impact\n\nThe library offers a function to generate an ed25519 key pair via `Ed25519KeyIdentity.generate` with an optional param to provide a 32 byte seed value, which will then be used as the secret key. **When no seed value is provided, it is expected that the library generates the secret key using secure randomness**. However, a recent change **broke this guarantee** and **uses an insecure seed for key pair generation**.\n\nSince the private key of this identity (`535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe`) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller. Users are asked to take proactive measures mentioned below in Workarounds:Users to protect their assets. \n\n## Patches\nPatch for the vulnerability is **available in v1.0.1** for all the packages listed in the advisory. Please upgrade and deploy your canisters immediately. \n\n## Workarounds\n\n### Developers\n\nThe recommended fix is to upgrade the package to the patched version. If that is not possible, there are couple of workarounds to handle the insecure key generation.\n\n1. Invoking the function as `Ed25519KeyIdentity.generate(null)` would fix the broken conditional evaluation and force the function to generate a securely random seed. However, this is not guaranteed to work for future upgrades.\n2. Passing a securely generated randomness as a seed to `Ed25519KeyIdentity.generate` would force the library to use it as the seed to generate the key pair.\n\n### Users\n\n#### Removing a controller of a canister if it\u0027s the affected principal\n\nFor all canisters you control, fetch the controllers of the canisters using \n```sh\ndfx canister info --ic \u003cCANISTER\u003e\n```\nIf you see the principal `535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe` as one of the controllers, follow the steps below \n```sh\ndfx identity whoami # record CURRENT_IDENTITY\n\ndfx identity new \u003cNEW_IDENTITY_NAME\u003e \ndfx identity use \u003cNEW_IDENTITY_NAME\u003e \ndfx identity get-principal \u003cNEW_IDENTITY_NAME\u003e # record NEW_IDENTITY_PRINCIPAL\n\ndfx identity use \u003cCURRENT_IDENTITY\u003e\ndfx canister update-settings --ic \u003cCANISTER\u003e --add-controller \u003cNEW_IDENTITY_PRINCIPAL\u003e\ndfx canister update-settings --ic \u003cCANISTER\u003e --remove-controller `535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe`\n```\nFor more details on canister management, please visit [here](https://internetcomputer.org/docs/current/tutorials/developer-journey/level-1/1.6-managing-canisters)\n\n#### Checking funds on wallets /  ledgers\n\nIf you have funds on ledgers using a browser wallet, please check if the account principal matches `535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe`. If it does, please create a new account and transfer the funds to the new account immediately.\n\n## References\n\n1. [fix PR link](https://github.com/dfinity/agent-js/pull/851)\n2. [NPM patched version](https://www.npmjs.com/package/@dfinity/identity/v/1.0.1)\n3. [agent-js Github repo](https://github.com/dfinity/agent-js)\n4. [agent-js docs](https://agent-js.icp.xyz/identity/index.html)\n\n",
  "id": "GHSA-c9vv-fhgv-cjc3",
  "modified": "2024-02-21T18:57:59Z",
  "published": "2024-02-21T02:54:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1631"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dfinity/agent-js/pull/851"
    },
    {
      "type": "WEB",
      "url": "https://agent-js.icp.xyz/identity/index.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dfinity/agent-js"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/@dfinity/identity/v/1.0.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-0355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-13T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information.",
  "id": "GHSA-cf26-j9p4-wm96",
  "modified": "2023-03-16T21:30:16Z",
  "published": "2023-03-13T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0355"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-48625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-20T00:15:14Z",
    "severity": "HIGH"
  },
  "details": "Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary.",
  "id": "GHSA-cr3p-h54g-qj4w",
  "modified": "2024-08-29T21:31:01Z",
  "published": "2024-02-20T00:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48625"
    },
    {
      "type": "WEB",
      "url": "https://www.yealink.com/en/trust-center/security-advisories/yealink-config-encrypt-tool-hardcoded-encryption-password-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-76847"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-24T14:17:02Z",
    "severity": "HIGH"
  },
  "details": "act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task\u0027s run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host\u0027s outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.",
  "id": "GHSA-crfw-6q9f-w49f",
  "modified": "2026-08-24T15:31:51Z",
  "published": "2026-08-24T15:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76847"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nektos/act"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nektos/act/blob/v0.2.89/cmd/root.go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nektos/act/blob/v0.2.89/pkg/artifacts/artifacts_v4.go"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/act-through-missing-authorization-in-the-artifacts-v4-backend"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-21404"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-311",
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-08T21:15:10Z",
    "severity": "MODERATE"
  },
  "details": "AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure communication nor can it be used to compromise the device or any customer data.",
  "id": "GHSA-cv37-j7vw-c2gc",
  "modified": "2024-04-04T03:52:42Z",
  "published": "2023-05-08T21:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21404"
    },
    {
      "type": "WEB",
      "url": "https://www.axis.com/dam/public/07/0a/20/cve-2023-21404-en-US-398426.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-2660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321",
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-13T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to decrypt sensitive data and compromise the machine.",
  "id": "GHSA-cx6m-hwfj-fvvw",
  "modified": "2024-04-04T03:15:50Z",
  "published": "2022-12-14T00:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2660"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-75431"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-04T16:17:59Z",
    "severity": "CRITICAL"
  },
  "details": "PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.",
  "id": "GHSA-f4hf-w5c6-r4p5",
  "modified": "2026-09-04T18:31:24Z",
  "published": "2026-09-04T18:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75431"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/unpredictable21/39e6ce22e4bc45b0e553d0fa6a6e4d1c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PowerJob/PowerJob/blob/master/docker-compose.yml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/DefaultSecretProvider.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/JwtServiceImpl.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-openapi/src/main/java/tech/powerjob/server/openapi/service/impl/OpenApiSecurityServiceImpl.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-starter/src/main/resources/application-daily.properties"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-19753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-30T18:15:19Z",
    "severity": "CRITICAL"
  },
  "details": "SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they have no plans to fix this, and discourage deployment using public IPv4.",
  "id": "GHSA-f63j-fm2w-2wxh",
  "modified": "2024-08-01T15:31:43Z",
  "published": "2024-04-30T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19753"
    },
    {
      "type": "WEB",
      "url": "https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html"
    },
    {
      "type": "WEB",
      "url": "https://simplemining.net/page/changelog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-42518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-29T09:16:25Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys.\n\nSuccessful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.",
  "id": "GHSA-f6hw-3rgq-5rhv",
  "modified": "2026-04-29T09:30:25Z",
  "published": "2026-04-29T09:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42518"
    },
    {
      "type": "WEB",
      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0207"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-19754"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-30T18:15:19Z",
    "severity": "MODERATE"
  },
  "details": "HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this.",
  "id": "GHSA-f7mm-6f83-q4xx",
  "modified": "2024-11-07T00:30:35Z",
  "published": "2024-04-30T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19754"
    },
    {
      "type": "WEB",
      "url": "https://hiveos.farm/changelog"
    },
    {
      "type": "WEB",
      "url": "https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}