CWE-321 Use of Hard-coded Cryptographic Key

HAXcms: Private Key Disclosure via Broken HMAC Implementation

praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

Netmaker has Hardcoded DNS Secret Key

Use of Hard-coded Cryptographic Key in Netmaker

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

FUXA has a hardcoded fallback JWT signing secret

Apache OpenMeetings Uses Hard-coded Cryptographic Key

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

EVE Has Partially Predetermined Vault Key

Duplicate Advisory: EVE Has Partially Predetermined Vault Key

SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key

NetBird uses a static initialization vector (IV)

Apache StreamPark has a hard-coded encryption key

Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

Apache Syncope's AES encryption stores hard-coded passwords in internal database

NeuVector is shipping cryptographic material into its binary

Improper Access Control in Apache Shiro

Dpanel's hard-coded JWT secret leads to remote code execution

Dragonfly2 has hard coded cyptographic key

@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys

agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

xkeys seal encryption used fixed key for all encryption

Use of Hard-coded Cryptographic Key in Apache Tomcat