# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint](https://agentprime.io/advisories/CVE-2025-67732.md)
  `CVE-2025-67732` · CVE record: langgenius dify · CVSS 8.4 High · Not analysed yet · Published 5 Jan 2026 · Tags: Information disclosure, Hard-coded credentials
- [Coolify members can see private key of root user](https://agentprime.io/advisories/CVE-2025-64420.md)
  `CVE-2025-64420` · CVE record: coollabsio coolify · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jan 2026 · Tags: Hard-coded credentials
- [Nuvation Energy Multi-Stack Controller Private Key Stored on Device](https://agentprime.io/advisories/CVE-2025-64122.md)
  `CVE-2025-64122` · CVE record: Nuvation Energy Multi-Stack Controller (MSC) · CVSS 7.2 High · Not analysed yet · Published 2 Jan 2026 · Tags: Hard-coded credentials
- [Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root](https://agentprime.io/advisories/CVE-2021-47744.md)
  `CVE-2021-47744` · CVE record: Cypress ONE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Dec 2025 · Tags: Hard-coded credentials
- [ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint](https://agentprime.io/advisories/CVE-2021-47741.md)
  `CVE-2021-47741` · CVE record: Zblchina ZBL EPON ONU Broadband Router · CVSS 8.7 High · Not analysed yet · Published 31 Dec 2025 · Tags: Hard-coded credentials
- [NuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration Backup](https://agentprime.io/advisories/CVE-2021-47726.md)
  `CVE-2021-47726` · CVE record: Nucom NuCom 11N Wireless Router · CVSS 8.7 High · Not analysed yet · Published 31 Dec 2025 · Tags: Hard-coded credentials
- [Tenda i24 Shadow File hard-coded credentials](https://agentprime.io/advisories/CVE-2025-15371.md)
  `CVE-2025-15371` · CVE record: Tenda i24 and 4 more · CVSS 8.5 High · Not analysed yet · Published 31 Dec 2025 · Tags: Hard-coded credentials
- [RustFS has a gRPC Hardcoded Token Authentication Bypass](https://agentprime.io/advisories/GHSA-h956-rh7x-ppgj.md)
  `GHSA-h956-rh7x-ppgj`, `CVE-2025-68926` · crates.io `rustfs`: affected `>=1.0.0-alpha.13, <1.0.0-alpha.78`, fixed in `1.0.0-alpha.78` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.32 · Not analysed yet · Published 30 Dec 2025 · Tags: Authentication bypass, Hard-coded credentials
- [Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability](https://agentprime.io/advisories/CVE-2025-15111.md)
  `CVE-2025-15111` · CVE record: Ksenia Security S.p.A. lares · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2025 · Tags: Hard-coded credentials
- [Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass](https://agentprime.io/advisories/CVE-2023-53983.md)
  `CVE-2023-53983` · CVE record: Ateme Anevia Flamingo XL/XS and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2025 · Tags: Hard-coded credentials
- [SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass](https://agentprime.io/advisories/CVE-2022-50696.md)
  `CVE-2022-50696` · CVE record: SOUND4 Ltd. Impact/Pulse/First and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2025 · Tags: Hard-coded credentials
- [PandaXGO PandaX JWT Secret config.yml hard-coded key](https://agentprime.io/advisories/CVE-2025-15108.md)
  `CVE-2025-15108` · CVE record: PandaXGO PandaX · CVSS 6.3 Medium · Not analysed yet · Published 27 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [getmaxun auth.ts hard-coded key](https://agentprime.io/advisories/CVE-2025-15105.md)
  `CVE-2025-15105` · CVE record: getmaxun maxun · CVSS 6.3 Medium · Not analysed yet · Published 27 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret](https://agentprime.io/advisories/CVE-2025-68948.md)
  `CVE-2025-68948` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 27 Dec 2025 · Tags: Hard-coded credentials
- [Hardcoding sensitive information](https://agentprime.io/advisories/CVE-2025-52601.md)
  `CVE-2025-52601` · CVE record: Hanwha Vision Co., Ltd. Device Manager · CVSS 6.3 Medium · Not analysed yet · Published 26 Dec 2025 · Tags: Hard-coded credentials
- [FaceSentry Access Control System 6.4.8 Remote SSH Root Access](https://agentprime.io/advisories/CVE-2019-25241.md)
  `CVE-2019-25241` · CVE record: iWT Ltd. FaceSentry Access Control System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Dec 2025 · Tags: Hard-coded credentials
- [FLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass](https://agentprime.io/advisories/CVE-2018-25138.md)
  `CVE-2018-25138` · CVE record: FLIR Systems FLIR AX8 Thermal Camera · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Dec 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in NVIDIA Isaac Launchable](https://agentprime.io/advisories/CVE-2025-33222.md)
  `CVE-2025-33222` · CVE record: NVIDIA Isaac Launchable · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Dec 2025 · Tags: Hard-coded credentials
- [Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2025-15016.md)
  `CVE-2025-15016` · CVE record: Ragic Enterprise Cloud Database · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2025 · Tags: Hard-coded credentials
- [CouchCMS reCAPTCHA config.example.php hard-coded key](https://agentprime.io/advisories/CVE-2025-15005.md)
  `CVE-2025-15005` · CVE record: CouchCMS · CVSS 6.3 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials.](https://agentprime.io/advisories/CVE-2025-67418.md)
  `CVE-2025-67418` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2025 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in Utarit Informatics' SoliClub](https://agentprime.io/advisories/CVE-2025-7358.md)
  `CVE-2025-7358` · CVE record: Utarit Informatics Services Inc. SoliClub · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2025 · Tags: Hard-coded credentials
- [Hardcoded Credentials in Utarit Informatics' SoliClub](https://agentprime.io/advisories/CVE-2025-1029.md)
  `CVE-2025-1029` · CVE record: Utarit Information Services Inc. SoliClub · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2025 · Tags: Hard-coded credentials
- [Default credentials in Dify thru 1.5.1.](https://agentprime.io/advisories/CVE-2025-56157.md)
  `CVE-2025-56157` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Hard-coded credentials
- [Open OnDemand affected by Apache proxy passing sensitive headers](https://agentprime.io/advisories/CVE-2025-66029.md)
  `CVE-2025-66029` · CVE record: OSC ondemand · CVSS 7.6 High · Not analysed yet · Published 17 Dec 2025 · Tags: Hard-coded credentials, CWE-523
- [Credential Disclosure vulnerability in Radiometer Products](https://agentprime.io/advisories/CVE-2025-14096.md)
  `CVE-2025-14096` · CVE record: Radiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS Analyzers and 2 more · CVSS 8.4 High · Not analysed yet · Published 17 Dec 2025 · Tags: Privilege escalation, Hard-coded credentials
- [The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate u…](https://agentprime.io/advisories/CVE-2025-65855.md)
  `CVE-2025-65855` · CVE record · CVSS 6.6 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-494
- [IBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability](https://agentprime.io/advisories/CVE-2025-14148.md)
  `CVE-2025-14148` · CVE record: IBM UCD - IBM DevOps Deploy · CVSS 6.5 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Hard-coded credentials
- [An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.](https://agentprime.io/advisories/CVE-2025-67809.md)
  `CVE-2025-67809` · CVE record · CVSS 4.7 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Hard-coded credentials
- [MartialBE one-hub docker-compose.yml hard-coded key](https://agentprime.io/advisories/CVE-2025-14651.md)
  `CVE-2025-14651` · CVE record: MartialBE one-hub · CVSS 6.3 Medium · Not analysed yet · Published 14 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [Hardcoded FTP Credentials within the firmware](https://agentprime.io/advisories/CVE-2025-36747.md)
  `CVE-2025-36747` · CVE record: Growatt ShineLan-X · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Dec 2025 · Tags: Hard-coded credentials
- [Undocumented backup Account and No Password Configuration Capability](https://agentprime.io/advisories/CVE-2025-36752.md)
  `CVE-2025-36752` · CVE record: Growatt ShineLan-X · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Dec 2025 · Tags: Hard-coded credentials
- [Gladinet CentreStack and TrioFox Hard Coded AES Keys](https://agentprime.io/advisories/CVE-2025-14611.md)
  `CVE-2025-14611` · CVE record: Gladinet CentreStack and TrioFox · CVSS 7.1 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.55 · Not analysed yet · Published 12 Dec 2025 · Tags: Hard-coded credentials
- [Apache StreamPark has a hard-coded encryption key](https://agentprime.io/advisories/GHSA-prv5-c2px-j9q3.md)
  `GHSA-prv5-c2px-j9q3`, `CVE-2025-54947` · Maven `org.apache.streampark:streampark`: affected `>=2.0.0, <2.1.7`, fixed in `2.1.7` · CVSS 5.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Hard-coded credentials
- [Apache Fineract: Server Key not masked](https://agentprime.io/advisories/CVE-2025-58130.md)
  `CVE-2025-58130` · CVE record: Apache Software Foundation Apache Fineract · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2025 · Tags: Hard-coded credentials
- [Apache Fineract: weak password policy](https://agentprime.io/advisories/CVE-2025-23408.md)
  `CVE-2025-23408` · CVE record: Apache Software Foundation Apache Fineract · CVSS 8.5 High · Not analysed yet · Published 12 Dec 2025 · Tags: Hard-coded credentials
- [FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API](https://agentprime.io/advisories/CVE-2025-67513.md)
  `CVE-2025-67513` · CVE record: FreePBX endpoint · CVSS 6.9 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Hard-coded credentials
- [QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure](https://agentprime.io/advisories/CVE-2020-36896.md)
  `CVE-2020-36896` · CVE record: Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology Co., Ltd. QiHang Media Web Digital Signage · CVSS 8.7 High · Not analysed yet · Published 10 Dec 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic keys in EZCast Pro II Dongle](https://agentprime.io/advisories/CVE-2025-13954.md)
  `CVE-2025-13954` · CVE record: EZCast EZCast Pro II · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2025 · Tags: Hard-coded credentials
- [The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on.](https://agentprime.io/advisories/CVE-2025-65823.md)
  `CVE-2025-65823` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2025 · Tags: Hard-coded credentials
- [ColdFusion | Insufficiently Protected Credentials (CWE-522)](https://agentprime.io/advisories/CVE-2025-64898.md)
  `CVE-2025-64898` · CVE record: Adobe ColdFusion · CVSS 5.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Hard-coded credentials
- [Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments](https://agentprime.io/advisories/GHSA-mv7p-34fv-4874.md)
  `GHSA-mv7p-34fv-4874`, `CVE-2025-13877` · npm `@nocobase/auth`: affected `<1.9.0-beta.18 || >=1.9.0, <1.9.23 || >=2.0.0-alpha.1, <2.0.0-alpha.52`, fixed in `1.9.0-beta.18`, `1.9.23`, `2.0.0-alpha.52` · CVSS 6.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Hard-coded credentials, CWE-320, CWE-1320
- [Hard-coded credentials in Siemens SIMATIC CN 4100](https://agentprime.io/advisories/CVE-2025-40938.md)
  `CVE-2025-40938` · CVE record: Siemens SIMATIC CN 4100 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Hard-coded credentials
- [Hardcoded User Password](https://agentprime.io/advisories/CVE-2025-41696.md)
  `CVE-2025-41696` · CVE record: Phoenix Contact FL SWITCH 2005 and 4 more · CVSS 4.6 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Hard-coded credentials
- [TOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentials](https://agentprime.io/advisories/CVE-2025-14126.md)
  `CVE-2025-14126` · CVE record: TOZED ZLT M30S and 1 more · CVSS 8.7 High · Not analysed yet · Published 6 Dec 2025 · Tags: Hard-coded credentials
- [Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass](https://agentprime.io/advisories/CVE-2025-34256.md)
  `CVE-2025-34256` · CVE record: Advantech Co., Ltd. WISE-DeviceOn Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2025 · Tags: Hard-coded credentials
- [Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.](https://agentprime.io/advisories/CVE-2025-65730.md)
  `CVE-2025-65730` · CVE record · CVSS 8.8 High · Not analysed yet · Published 5 Dec 2025 · Tags: Hard-coded credentials
- [Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-66237.md)
  `CVE-2025-66237` · CVE record: Sunbird DCIM dcTrack and 1 more · CVSS 8.4 High · Not analysed yet · Published 4 Dec 2025 · Tags: Hard-coded credentials
- [Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext.](https://agentprime.io/advisories/CVE-2025-63361.md)
  `CVE-2025-63361` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: Hard-coded credentials
- [An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices.](https://agentprime.io/advisories/CVE-2025-53963.md)
  `CVE-2025-53963` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2025 · Tags: Hard-coded credentials
- [ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.](https://agentprime.io/advisories/CVE-2025-29268.md)
  `CVE-2025-29268` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2025 · Tags: Hard-coded credentials
- [opsre go-ldap-admin JWT docker-compose.yaml hard-coded key](https://agentprime.io/advisories/CVE-2025-13948.md)
  `CVE-2025-13948` · CVE record: opsre go-ldap-admin · CVSS 6.3 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: Hard-coded credentials, CWE-320
- [Mirion Medical EC2 Software NMIS BioDose Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-64778.md)
  `CVE-2025-64778` · CVE record: Mirion Medical EC2 Software NMIS BioDose · CVSS 8.4 High · Not analysed yet · Published 2 Dec 2025 · Tags: Hard-coded credentials
- [arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints](https://agentprime.io/advisories/GHSA-g2jx-37x6-6438.md)
  `GHSA-g2jx-37x6-6438`, `CVE-2025-66454`, `PYSEC-2026-1192` · PyPI `arcade-mcp-server`: affected `<1.9.1`, fixed in `1.9.1` · CVSS 6.5 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: Broken access control, Hard-coded credentials
- [Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50](https://agentprime.io/advisories/CVE-2025-11781.md)
  `CVE-2025-11781` · CVE record: SGE-PLC1000 SGE-PLC50 Circutor · CVSS 8.6 High · Not analysed yet · Published 2 Dec 2025 · Tags: Hard-coded credentials
- [motogadget mo.lock Ignition Lock NFC hard-coded key](https://agentprime.io/advisories/CVE-2025-6666.md)
  `CVE-2025-6666` · CVE record: motogadget mo.lock Ignition Lock · CVSS 1.0 Low · Not analysed yet · Published 29 Nov 2025 · Tags: Hard-coded credentials, CWE-320
- [Hard-coded cryptographic key in Fuji Television Network, Inc. "FOD" App for Android and others](https://agentprime.io/advisories/CVE-2025-64304.md)
  `CVE-2025-64304` · CVE record: Fuji Television Network, Inc. "FOD" App for Android and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: Hard-coded credentials
- [TVT NVMS-9000 Hard-coded API Credentials & Command Injection](https://agentprime.io/advisories/CVE-2018-25126.md)
  `CVE-2018-25126` · CVE record: Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Nov 2025 · Tags: Command injection, Hard-coded credentials
- [Apache Syncope's AES encryption stores hard-coded passwords in internal database](https://agentprime.io/advisories/GHSA-jqg8-m35q-jh7j.md)
  `GHSA-jqg8-m35q-jh7j`, `CVE-2025-65998` · Maven `org.apache.syncope:syncope-core`: affected `>=4.0.0, <4.0.3 || <3.0.15`, fixed in `4.0.3`, `3.0.15` · CVSS 7.5 High · Not analysed yet · Published 24 Nov 2025 · Tags: Hard-coded credentials
- [Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata.](https://agentprime.io/advisories/CVE-2025-63433.md)
  `CVE-2025-63433` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI1LTExLTI0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS02MzQzMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI2LTAxLTA2VDE1OjUyOjI0LjM1MDAwMFoiLCJDVkUtMjAyMC0zNjkxNSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI2LTAxLTA2VDE1OjUyOjI0LjM1MDAwMFoiLCJDVkUtMjAyMC0zNjkxNSJd>. Everything for agents: <https://agentprime.io/llms.txt>.