CWE-1392 Use of Default Credentials
Description
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1392 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-p77j-g7h5-r2vw | - | HIGH |
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4) |
2026-08-19 | |
| GHSA-f25v-x6vr-962g | - | CRITICAL | - |
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password |
2026-07-24 |
| GHSA-2hp7-65r3-wv54 | CVE-2026-42072 | CRITICAL |
NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access |
2026-05-13 | |
| GHSA-g3j4-58mp-3x25 | CVE-2025-10678 | CRITICAL |
NetBird VPN does not remove the default password of an admin account |
2025-10-20 | |
| GHSA-pr72-8fxw-xx22 | CVE-2025-55740 | MODERATE |
Default Credentials in nginx-defender Configuration Files |
2025-08-29 | |
| GHSA-cm2r-rg7r-p7gg | CVE-2025-52997 | MODERATE |
File Browser vulnerable to insecure password handling |
2025-08-04 | |
| GHSA-5fpv-5qvh-7cf3 | CVE-2025-54137 | HIGH |
NodeJS version of the HAX CMS application is distributed with Default Secrets |
2025-07-23 | |
| GHSA-w799-v85j-88pg | CVE-2024-6535 | HIGH |
Skupper uses a static cookie secret for the openshift oauth-proxy |
2024-11-18 |