CWE-798 Use of Hard-coded Credentials
Description
The product contains hard-coded credentials, such as a password or cryptographic key.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-798 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-6xp5-7rcx-xfgx | CVE-2026-62252 | CRITICAL |
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login |
2026-10-07 | |
| GHSA-gg6r-gp4c-89hp | - | CRITICAL |
Trigger.dev: V1 coordinator default-secret unauth Socket.IO |
2026-10-02 | |
| GHSA-365w-hqf6-vxfg | CVE-2026-56266 | CRITICAL |
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution |
2026-09-23 | |
| GHSA-w72w-9qmj-c9qm | CVE-2026-63406 | MODERATE |
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets |
2026-09-18 | |
| GHSA-8qrg-7j2f-rf2h | CVE-2026-56265 | CRITICAL |
Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server |
2026-09-14 | |
| GHSA-2j95-gqxf-v3vg | CVE-2026-11746 | CRITICAL |
Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover |
2026-09-11 | |
| GHSA-f4vv-55c2-5789 | CVE-2026-61740 | CRITICAL |
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection |
2026-07-20 | |
| GHSA-m7mq-85xj-9x33 | CVE-2026-56269 | MODERATE |
Flowise: Weak Default Token Hash Secret |
2026-07-20 | |
| GHSA-f38v-77qj-h4jq | CVE-2026-57148 | CRITICAL |
praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) |
2026-07-20 | |
| GHSA-cwj8-7gp2-ggcw | CVE-2026-57147 | CRITICAL |
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery |
2026-07-20 | |
| GHSA-p4h7-p9rj-2pq2 | CVE-2026-55579 | CRITICAL | - |
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise |
2026-07-16 |
| GHSA-qhr7-h655-pw6r | CVE-2026-44825 | HIGH |
Apache Solr has hardcoded credentials in the Basic Authentication setup tool |
2026-07-09 | |
| GHSA-jphh-m39h-6gwx | CVE-2026-49352 | CRITICAL |
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass |
2026-07-02 | |
| GHSA-v9q6-fm48-rx74 | CVE-2024-3408 | HIGH |
Authentication bypass in dtale |
2026-06-10 | |
| GHSA-mqq6-462x-jxmm | CVE-2026-48031 | CRITICAL |
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery |
2026-06-10 | |
| GHSA-h3h8-3v2v-rg7m | CVE-2026-27167 | LOW |
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret |
2026-06-05 | |
| GHSA-3qg8-5g3r-79v5 | CVE-2026-47410 | CRITICAL |
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset |
2026-05-29 | |
| GHSA-wjjv-3mj2-39hf | CVE-2026-47255 | HIGH |
AgenticMail API/storage and outbound relay hardening fixes |
2026-05-29 | |
| GHSA-8x8h-hcq8-jwwx | CVE-2023-32077 | HIGH |
Netmaker has Hardcoded DNS Secret Key |
2026-05-19 | |
| GHSA-86f3-hf24-76q4 | CVE-2022-23650 | HIGH |
Use of Hard-coded Cryptographic Key in Netmaker |
2026-05-19 | |
| GHSA-4m32-cjv7-f425 | CVE-2025-55449 | CRITICAL |
AstrBot is vulnerable to RCE with hard-coded JWT signing keys |
2026-05-12 | |
| GHSA-c8m8-3jcr-6rj5 | CVE-2025-69971 | HIGH |
FUXA has a hardcoded fallback JWT signing secret |
2026-05-11 | |
| GHSA-2r8f-cf6w-x5vq | - | HIGH |
Duplicate Advisory: FUXA contains a hard-coded credential vulnerability |
2026-05-11 | |
| GHSA-8pqq-224h-x875 | - | MODERATE |
ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key |
2026-05-05 | |
| GHSA-2qqc-p94c-hxwh | - | MODERATE |
Flowise: Weak Default Express Session Secret |
2026-04-16 |