# CWE-320.

Every Advisory and CVE whose sources give the weakness CWE-320, newest first.

## Records, newest first

- [OctoPrint Flask Secret Key hard-coded key](https://agentprime.io/advisories/CVE-2014-125135.md)
  `CVE-2014-125135` · CVE record: OctoPrint · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Hard-coded credentials, CWE-320
- [MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key](https://agentprime.io/advisories/CVE-2026-113466.md)
  `CVE-2026-113466` · CVE record: MinIO · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials, CWE-320
- [ZKTeco BioTime hard-coded key](https://agentprime.io/advisories/CVE-2026-108798.md)
  `CVE-2026-108798` · CVE record: ZKTeco BioTime · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Hard-coded credentials, CWE-320
- [Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key](https://agentprime.io/advisories/CVE-2026-105392.md)
  `CVE-2026-105392` · CVE record: Lybbn Django-Vue-Lyadmin · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Hard-coded credentials, CWE-320
- [Netcore NAP930 Backup/Restore backup_common.sh hard-coded key](https://agentprime.io/advisories/CVE-2026-102241.md)
  `CVE-2026-102241` · CVE record: Netcore NAP930 · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials, CWE-320
- [dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key](https://agentprime.io/advisories/CVE-2026-90510.md)
  `CVE-2026-90510` · CVE record: dromara orion-visor · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Hard-coded credentials, CWE-320
- [liufee FeehiCMS Cookie Validation main-local.php hard-coded key](https://agentprime.io/advisories/CVE-2026-86241.md)
  `CVE-2026-86241` · CVE record: liufee FeehiCMS · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Hard-coded credentials, CWE-320
- [capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution](https://agentprime.io/advisories/CVE-2026-56254.md)
  `CVE-2026-56254` · CVE record: capacitor-updater capacitor-updater · CVSS 8.3 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-320
- [GL.iNet XE3000 glnassys hard-coded key](https://agentprime.io/advisories/CVE-2026-11505.md)
  `CVE-2026-11505` · CVE record: GL.iNet A1300 and 4 more · CVSS 2.3 Low · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials, CWE-320
- [Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key](https://agentprime.io/advisories/CVE-2026-8739.md)
  `CVE-2026-8739` · CVE record: Sanluan PublicCMS · CVSS 6.9 Medium · Not analysed yet · Published 17 May 2026 · Tags: Hard-coded credentials, CWE-320
- [Industrial Application Software IAS Canias ERP JNLP Deployment Endpoint hard-coded key](https://agentprime.io/advisories/CVE-2026-8243.md)
  `CVE-2026-8243` · CVE record: Industrial Application Software IAS Canias ERP · CVSS 6.9 Medium · Not analysed yet · Published 10 May 2026 · Tags: Hard-coded credentials, CWE-320
- [Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key](https://agentprime.io/advisories/CVE-2026-7306.md)
  `CVE-2026-7306` · CVE record: Xuxueli xxl-job · CVSS 6.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Datavane Datavines JWT Token TokenManager.java hard-coded key](https://agentprime.io/advisories/CVE-2026-7018.md)
  `CVE-2026-7018` · CVE record: Datavane Datavines · CVSS 6.3 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key](https://agentprime.io/advisories/CVE-2026-6611.md)
  `CVE-2026-6611` · CVE record: liangliangyy DjangoBlog · CVSS 2.3 Low · Not analysed yet · Published 20 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [liangliangyy DjangoBlog Amap API Call views.py hard-coded key](https://agentprime.io/advisories/CVE-2026-6580.md)
  `CVE-2026-6580` · CVE record: liangliangyy DjangoBlog · CVSS 6.9 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [hcengineering Huly Platform JWT Token token.ts hard-coded key](https://agentprime.io/advisories/CVE-2026-5622.md)
  `CVE-2026-5622` · CVE record: hcengineering Huly Platform · CVSS 6.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Tenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded key](https://agentprime.io/advisories/CVE-2026-5549.md)
  `CVE-2026-5549` · CVE record: Tenda AC10 · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key](https://agentprime.io/advisories/CVE-2026-5527.md)
  `CVE-2026-5527` · CVE record: Tenda 4G03 Pro · CVSS 6.9 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded key](https://agentprime.io/advisories/CVE-2026-5471.md)
  `CVE-2026-5471` · CVE record: Investory Toy Planet Trouble App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5462.md)
  `CVE-2026-5462` · CVE record: Wahoo Fitness SYSTM App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5458.md)
  `CVE-2026-5458` · CVE record: Noelse Individuals & Pro App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5457.md)
  `CVE-2026-5457` · CVE record: PropertyGuru AgentNet Singapore App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5456.md)
  `CVE-2026-5456` · CVE record: Align Technology My Invisalign App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Dialogue App ca.diagram.dialogue config.json hard-coded key](https://agentprime.io/advisories/CVE-2026-5455.md)
  `CVE-2026-5455` · CVE record: Dialogue App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [GRID Organiser App co.gridapp.organiser app.json hard-coded key](https://agentprime.io/advisories/CVE-2026-5454.md)
  `CVE-2026-5454` · CVE record: GRID Organiser App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5453.md)
  `CVE-2026-5453` · CVE record: Rico só vantagem pra investir App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5452.md)
  `CVE-2026-5452` · CVE record: UCC CampusConnect App · CVSS 4.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key](https://agentprime.io/advisories/CVE-2026-5420.md)
  `CVE-2026-5420` · CVE record: Shinrays Games Goods Triple App · CVSS 2.0 Low · Not analysed yet · Published 2 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [Enter Software Iperius Backup IperiusAccounts.ini hard-coded key](https://agentprime.io/advisories/CVE-2026-5310.md)
  `CVE-2026-5310` · CVE record: Enter Software Iperius Backup · CVSS 2.0 Low · Not analysed yet · Published 1 Apr 2026 · Tags: Hard-coded credentials, CWE-320
- [kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key](https://agentprime.io/advisories/CVE-2026-4588.md)
  `CVE-2026-4588` · CVE record: kalcaddle kodbox · CVSS 6.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Hard-coded credentials, CWE-320
- [Yi Technology YI Home Camera WPA/WPS hard-coded key](https://agentprime.io/advisories/CVE-2026-4477.md)
  `CVE-2026-4477` · CVE record: Yi Technology YI Home Camera · CVSS 2.3 Low · Not analysed yet · Published 20 Mar 2026 · Tags: Hard-coded credentials, CWE-320
- [perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key](https://agentprime.io/advisories/CVE-2026-3963.md)
  `CVE-2026-3963` · CVE record: perfree go-fastdfs-web · CVSS 6.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Hard-coded credentials, CWE-320
- [OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback](https://agentprime.io/advisories/GHSA-v6x2-2qvm-6gv8.md)
  `GHSA-v6x2-2qvm-6gv8`, `CVE-2026-32897` · npm `openclaw`: affected `<2026.2.22`, fixed in `2026.2.22` · CVSS 6.3 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials, CWE-320
- [SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle](https://agentprime.io/advisories/GHSA-43h9-hc38-qph5.md)
  `GHSA-43h9-hc38-qph5`, `CVE-2025-15107`, `GO-2025-4269` · Go `github.com/actiontech/sqle`: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 12 Jan 2026 · Tags: Hard-coded credentials, CWE-320
- [PandaXGO PandaX JWT Secret config.yml hard-coded key](https://agentprime.io/advisories/CVE-2025-15108.md)
  `CVE-2025-15108` · CVE record: PandaXGO PandaX · CVSS 6.3 Medium · Not analysed yet · Published 27 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [getmaxun auth.ts hard-coded key](https://agentprime.io/advisories/CVE-2025-15105.md)
  `CVE-2025-15105` · CVE record: getmaxun maxun · CVSS 6.3 Medium · Not analysed yet · Published 27 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [CouchCMS reCAPTCHA config.example.php hard-coded key](https://agentprime.io/advisories/CVE-2025-15005.md)
  `CVE-2025-15005` · CVE record: CouchCMS · CVSS 6.3 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [MartialBE one-hub docker-compose.yml hard-coded key](https://agentprime.io/advisories/CVE-2025-14651.md)
  `CVE-2025-14651` · CVE record: MartialBE one-hub · CVSS 6.3 Medium · Not analysed yet · Published 14 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [Fortinet FortiAnalyzer: A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2…](https://agentprime.io/advisories/CVE-2024-40593.md)
  `CVE-2024-40593` · CVE record: Fortinet FortiAnalyzer and 3 more · CVSS 5.9 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-320
- [Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments](https://agentprime.io/advisories/GHSA-mv7p-34fv-4874.md)
  `GHSA-mv7p-34fv-4874`, `CVE-2025-13877` · npm `@nocobase/auth`: affected `<1.9.0-beta.18 || >=1.9.0, <1.9.23 || >=2.0.0-alpha.1, <2.0.0-alpha.52`, fixed in `1.9.0-beta.18`, `1.9.23`, `2.0.0-alpha.52` · CVSS 6.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Hard-coded credentials, CWE-320, CWE-1320
- [opsre go-ldap-admin JWT docker-compose.yaml hard-coded key](https://agentprime.io/advisories/CVE-2025-13948.md)
  `CVE-2025-13948` · CVE record: opsre go-ldap-admin · CVSS 6.3 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [motogadget mo.lock Ignition Lock NFC hard-coded key](https://agentprime.io/advisories/CVE-2025-6666.md)
  `CVE-2025-6666` · CVE record: motogadget mo.lock Ignition Lock · CVSS 1.0 Low · Not analysed yet · Published 29 Nov 2025 · Tags: Hard-coded credentials, CWE-320
- [PHPGurukul News Portal settings.py hard-coded key](https://agentprime.io/advisories/CVE-2025-12615.md)
  `CVE-2025-12615` · CVE record: PHPGurukul News Portal · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2025 · Tags: Hard-coded credentials, CWE-320
- [code-projects Hospital Management System express-session hard-coded key](https://agentprime.io/advisories/CVE-2025-11609.md)
  `CVE-2025-11609` · CVE record: code-projects Hospital Management System · CVSS 6.3 Medium · Not analysed yet · Published 11 Oct 2025 · Tags: Hard-coded credentials, CWE-320
- [CRMEB JWT HMAC Secret hard-coded key](https://agentprime.io/advisories/CVE-2025-11290.md)
  `CVE-2025-11290` · CVE record: CRMEB · CVSS 6.3 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Hard-coded credentials, CWE-320
- [DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key](https://agentprime.io/advisories/CVE-2025-10250.md)
  `CVE-2025-10250` · CVE record: DJI Mavic Spark and 2 more · CVSS 2.3 Low · Not analysed yet · Published 11 Sept 2025 · Tags: Hard-coded credentials, CWE-320
- [running-elephant Datart API AESUtil.java getTokensecret hard-coded key](https://agentprime.io/advisories/CVE-2025-10080.md)
  `CVE-2025-10080` · CVE record: running-elephant Datart · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2025 · Tags: Hard-coded credentials, CWE-320
- [coze-studio aes.go hard-coded key](https://agentprime.io/advisories/CVE-2025-9604.md)
  `CVE-2025-9604` · CVE record: coze-studio · CVSS 6.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Hard-coded credentials, CWE-320
- [TRENDnet TN-200 Lighttpd hard-coded key](https://agentprime.io/advisories/CVE-2025-8759.md)
  `CVE-2025-8759` · CVE record: TRENDnet TN-200 · CVSS 6.3 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Hard-coded credentials, CWE-320
- [gooaclok819 sublinkX jwt.go hard-coded key](https://agentprime.io/advisories/CVE-2025-6669.md)
  `CVE-2025-6669` · CVE record: gooaclok819 sublinkX · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Hard-coded credentials, CWE-320
- [PerfreeBlog JWT JwtUtil hard-coded key](https://agentprime.io/advisories/CVE-2025-5164.md)
  `CVE-2025-5164` · CVE record: PerfreeBlog · CVSS 6.3 Medium · Not analysed yet · Published 26 May 2025 · Tags: Hard-coded credentials, CWE-320
- [FastCMS JWT hard-coded key](https://agentprime.io/advisories/CVE-2025-3177.md)
  `CVE-2025-3177` · CVE record: FastCMS · CVSS 2.3 Low · Not analysed yet · Published 3 Apr 2025 · Tags: Hard-coded credentials, CWE-320
- [Odyssey CMS reCAPTCHA odyssey_contact_form.php key management](https://agentprime.io/advisories/CVE-2025-2220.md)
  `CVE-2025-2220` · CVE record: Odyssey CMS · CVSS 4.8 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-320
- [mariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded key](https://agentprime.io/advisories/CVE-2024-10920.md)
  `CVE-2024-10920` · CVE record: mariazevedo88 travels-java-api · CVSS 2.3 Low · Not analysed yet · Published 6 Nov 2024 · Tags: Hard-coded credentials, CWE-320
- [MileSight DeviceHub - CWE-320: Key Management Errors](https://agentprime.io/advisories/CVE-2024-36391.md)
  `CVE-2024-36391` · CVE record: MileSight DeviceHub · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2024 · Tags: CWE-320
- [Key Management Errors in HLOS](https://agentprime.io/advisories/CVE-2023-21652.md)
  `CVE-2023-21652` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.7 High · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-320
- [Improper Authentication in HLOS.](https://agentprime.io/advisories/CVE-2023-21626.md)
  `CVE-2023-21626` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.1 High · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-320
- [Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.](https://agentprime.io/advisories/CVE-2021-26322.md)
  `CVE-2021-26322` · CVE record: AMD 1st Gen AMD EPYC™ and 2 more · No CVSS score · Not analysed yet · Published 16 Nov 2021 · Tags: CWE-320
- [Junos OS: SRX and NFX Series: Insufficient Web API private key protection](https://agentprime.io/advisories/CVE-2020-1688.md)
  `CVE-2020-1688` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2020 · Tags: Information disclosure, Hard-coded credentials, CWE-320
- [Cisco HyperFlex Static SSL Key Vulnerability](https://agentprime.io/advisories/CVE-2019-12621.md)
  `CVE-2019-12621` · CVE record: Cisco Cisco HyperFlex HX-Series · CVSS 6.8 Medium · Not analysed yet · Published 21 Aug 2019 · Tags: CWE-320

Older: <https://agentprime.io/advisories/tag/cwe-320.md?cursor=WyIyMDE5LTA4LTIxVDE4OjAwOjI4LjYwNjAwMFoiLCJDVkUtMjAxOS0xMjYyMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-320>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-320/>. Everything for agents: <https://agentprime.io/llms.txt>.