CWE-1391 Use of Weak Credentials
Description
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1391 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-gg9x-qcx2-xmrh | CVE-2026-49852 | HIGH |
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) |
2026-07-02 | |
| GHSA-gxhx-2686-5h9g | - | MODERATE |
slack-go `SecretsVerifier` accepts empty signing secret without precondition |
2026-06-29 | |
| GHSA-gf57-4mp6-m85x | CVE-2026-46623 | HIGH |
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module |
2026-06-26 | |
| GHSA-c32j-vqhx-rx3x | CVE-2026-45363 | HIGH |
ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351 |
2026-06-02 | |
| GHSA-gmvf-9v4p-v8jc | CVE-2026-44351 | CRITICAL |
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver |
2026-05-14 | |
| GHSA-phh4-3hmm-24rx | - | HIGH |
Duplicate Advisory: Juju makes Use of Weak Credentials |
2025-08-26 | |
| GHSA-q5q7-8x6x-hcg2 | CVE-2025-4057 | MODERATE |
ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse |
2025-07-31 | |
| GHSA-m5q5-8mfw-p2hr | CVE-2023-37266 | CRITICAL |
CasaOS contains weak JWT secrets |
2024-12-12 | |
| GHSA-mh98-763h-m9v4 | CVE-2024-7558 | MODERATE |
JUJU_CONTEXT_ID is a predictable authentication secret |
2024-10-09 | |
| GHSA-9v64-447r-wch6 | CVE-2014-7845 | HIGH | - |
Moodle Temporary Passwords are Brute Force-able |
2024-01-24 |