CWE-798
Allowed-with-ReviewUse of Hard-coded Credentials
Abstraction: Base · Status: Draft
The product contains hard-coded credentials, such as a password or cryptographic key.
2399 vulnerabilities reference this CWE, most recent first.
GHSA-65C3-X7X6-JMFM
Vulnerability from github – Published: 2024-12-16 21:30 – Updated: 2024-12-17 18:33ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.
{
"affected": [],
"aliases": [
"CVE-2024-55557"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-16T21:15:08Z",
"severity": "CRITICAL"
},
"details": "ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.",
"id": "GHSA-65c3-x7x6-jmfm",
"modified": "2024-12-17T18:33:47Z",
"published": "2024-12-16T21:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55557"
},
{
"type": "WEB",
"url": "https://apps.microsoft.com/detail/9nhtv46lg4nh?hl=en-us\u0026gl=US"
},
{
"type": "WEB",
"url": "https://github.com/nroduit/Weasis/releases/tag/v4.5.1"
},
{
"type": "WEB",
"url": "https://github.com/partywavesec/CVE-2024-55557"
},
{
"type": "WEB",
"url": "https://www.partywave.site/show/research/CVE-2024-55557%20-%20Weasis%204.5.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-65CH-M8FQ-JHR5
Vulnerability from github – Published: 2026-06-12 15:30 – Updated: 2026-06-12 15:30The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot's command topic using only the robot's serial number.
{
"affected": [],
"aliases": [
"CVE-2026-10557"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T15:16:24Z",
"severity": "CRITICAL"
},
"details": "The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription to all robot telemetry topics and publishing to any robot\u0027s command topic using only the robot\u0027s serial number.",
"id": "GHSA-65ch-m8fq-jhr5",
"modified": "2026-06-12T15:30:35Z",
"published": "2026-06-12T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10557"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-65FR-GPW6-J777
Vulnerability from github – Published: 2023-05-22 21:30 – Updated: 2024-04-04 04:16Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.
{
"affected": [],
"aliases": [
"CVE-2023-31240"
],
"database_specific": {
"cwe_ids": [
"CWE-1391",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-22T20:15:10Z",
"severity": "CRITICAL"
},
"details": "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nSnap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",
"id": "GHSA-65fr-gpw6-j777",
"modified": "2024-04-04T04:16:46Z",
"published": "2023-05-22T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31240"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01"
},
{
"type": "WEB",
"url": "https://www.control4.com/docs/product/ovrc-software/release-notes/english/latest/ovrc-software-release-notes-rev-r.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-65H5-C5P7-M3FP
Vulnerability from github – Published: 2026-03-10 18:31 – Updated: 2026-03-10 18:31An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.
{
"affected": [],
"aliases": [
"CVE-2025-41710"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-10T18:17:56Z",
"severity": "MODERATE"
},
"details": "An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.",
"id": "GHSA-65h5-c5p7-m3fp",
"modified": "2026-03-10T18:31:18Z",
"published": "2026-03-10T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41710"
},
{
"type": "WEB",
"url": "https://certvde.com/en/advisories/VDE-2025-079"
},
{
"type": "WEB",
"url": "https://certvde.com/en/advisories/VDE-2025-096"
},
{
"type": "WEB",
"url": "https://janitza.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-079.json"
},
{
"type": "WEB",
"url": "https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-096.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-65H8-8V7V-FPC7
Vulnerability from github – Published: 2022-11-25 21:30 – Updated: 2022-12-01 21:30A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.
{
"affected": [],
"aliases": [
"CVE-2022-41157"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-25T19:15:00Z",
"severity": "CRITICAL"
},
"details": "A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.",
"id": "GHSA-65h8-8v7v-fpc7",
"modified": "2022-12-01T21:30:21Z",
"published": "2022-11-25T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41157"
},
{
"type": "WEB",
"url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67042"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-65X8-8358-VGRJ
Vulnerability from github – Published: 2026-03-10 18:31 – Updated: 2026-03-10 18:31CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default.
{
"affected": [],
"aliases": [
"CVE-2025-13957"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-10T18:17:52Z",
"severity": "HIGH"
},
"details": "CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default.",
"id": "GHSA-65x8-8358-vgrj",
"modified": "2026-03-10T18:31:18Z",
"published": "2026-03-10T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13957"
},
{
"type": "WEB",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-069-05.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-669P-R7M5-537J
Vulnerability from github – Published: 2022-05-17 02:16 – Updated: 2025-04-20 03:41WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.
{
"affected": [],
"aliases": [
"CVE-2017-2280"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-02T16:29:00Z",
"severity": "HIGH"
},
"details": "WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.",
"id": "GHSA-669p-r7m5-537j",
"modified": "2025-04-20T03:41:57Z",
"published": "2022-05-17T02:16:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2280"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN01312667/index.html"
},
{
"type": "WEB",
"url": "http://www.iodata.jp/support/information/2017/wn-ax1167gr"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6762-8X76-3VRF
Vulnerability from github – Published: 2025-04-29 18:30 – Updated: 2025-04-29 18:30{
"affected": [],
"aliases": [
"CVE-2025-23179"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-29T16:15:30Z",
"severity": "MODERATE"
},
"details": "CWE-798: Use of Hard-coded Credentials",
"id": "GHSA-6762-8x76-3vrf",
"modified": "2025-04-29T18:30:57Z",
"published": "2025-04-29T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23179"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-676R-WMG9-6WW8
Vulnerability from github – Published: 2023-02-09 21:30 – Updated: 2023-02-21 18:30Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.
{
"affected": [],
"aliases": [
"CVE-2023-21426"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-09T19:15:00Z",
"severity": "MODERATE"
},
"details": "Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.",
"id": "GHSA-676r-wmg9-6ww8",
"modified": "2023-02-21T18:30:25Z",
"published": "2023-02-09T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21426"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2023\u0026month=01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-67X4-QR35-QVRM
Vulnerability from github – Published: 2022-10-05 21:26 – Updated: 2024-05-20 21:35Impact
Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet.
In an effort to make enabling authentication easier for Flyte administrators, the default configuration for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password. This password is also set on the default Flyte Propeller configmap in the various Flyte Helm charts. Users who enable auth but do not override this setting in Flyte Admin’s configuration may unknowingly allow public traffic in by way of this default password with attackers effectively impersonating propeller. This only applies to users who have not specified the ExternalAuthorizationServer setting. Using an external auth server automatically turns off this default configuration is not susceptible to this vulnerability.
Patches
1.1.44
Workarounds
Users should manually set the staticClients in the selfAuthServer section of their configuration if they intend to rely on Admin’s internal auth server.
References
https://github.com/flyteorg/flyteadmin/pull/478 https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server
For more information
If you have any questions or comments about this advisory: * Open an issue in Flyte * Email us here
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/flyteorg/flyteadmin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.44"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39273"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-05T21:26:26Z",
"nvd_published_at": "2022-10-06T18:16:00Z",
"severity": "HIGH"
},
"details": "### Impact\nUsers who enable the default [Flyte\u2019s authorization server](https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server) without changing the default clientid hashes will be exposed to the public internet.\n\nIn an effort to make enabling authentication easier for Flyte administrators, the default configuration for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password. This password is also set on the default Flyte Propeller configmap in the various Flyte Helm charts. Users who enable auth but do not override this setting in Flyte Admin\u2019s configuration may unknowingly allow public traffic in by way of this default password with attackers effectively impersonating propeller. This only applies to users who have not specified the ExternalAuthorizationServer setting. Using an external auth server automatically turns off this default configuration is not susceptible to this vulnerability.\n\n### Patches\n1.1.44\n\n### Workarounds\nUsers should manually set the staticClients in the selfAuthServer section of their configuration if they intend to rely on Admin\u2019s internal auth server. \n\n### References\nhttps://github.com/flyteorg/flyteadmin/pull/478\nhttps://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server \n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Flyte](https://github.com/flyteorg/flyte/issues)\n* Email us [here](mailto:admin@flyte.org)",
"id": "GHSA-67x4-qr35-qvrm",
"modified": "2024-05-20T21:35:54Z",
"published": "2022-10-05T21:26:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-67x4-qr35-qvrm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39273"
},
{
"type": "WEB",
"url": "https://github.com/flyteorg/flyteadmin/pull/478"
},
{
"type": "WEB",
"url": "https://github.com/flyteorg/flyteadmin/commit/281172edf55fe6800959238fc128964ead6d9101"
},
{
"type": "WEB",
"url": "https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server"
},
{
"type": "PACKAGE",
"url": "https://github.com/flyteorg/flyteadmin"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-1043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "FlyteAdmin\u0027s Default OAuth Authorization Server secret must be rotated"
}
Mitigation
- For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
- In Windows environments, the Encrypted File System (EFS) may provide some protection.
Mitigation
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
Mitigation
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
Mitigation
- For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
- Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
Mitigation
- For front-end to back-end connections: Three solutions are possible, although none are complete.
- The first suggestion involves the use of generated passwords or keys that are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals.
- Next, the passwords or keys should be limited at the back end to only performing actions valid for the front end, as opposed to having full access.
- Finally, the messages sent should be tagged and checksummed with time sensitive values so as to prevent replay-style attacks.
CAPEC-191: Read Sensitive Constants Within an Executable
An adversary engages in activities to discover any sensitive constants present within the compiled code of an executable. These constants may include literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis.
CAPEC-70: Try Common or Default Usernames and Passwords
An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.