# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Server-side request forgery in Eclipse Foundation Eclipse Che](https://agentprime.io/advisories/CVE-2026-86671.md)
  `CVE-2026-86671` · CVE record: Eclipse Foundation Eclipse Che · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Hard-coded credentials, Server-side request forgery (SSRF)
- [SciPhi-AI R2R JWT Secret hard-coded credentials](https://agentprime.io/advisories/CVE-2026-105147.md)
  `CVE-2026-105147` · CVE record: SciPhi-AI R2R · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Hard-coded credentials
- [topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials](https://agentprime.io/advisories/CVE-2026-105141.md)
  `CVE-2026-105141` · CVE record: topoteretes cognee · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Hard-coded credentials
- [Trigger.dev: V1 coordinator default-secret unauth Socket.IO](https://agentprime.io/advisories/GHSA-gg6r-gp4c-89hp.md)
  `GHSA-gg6r-gp4c-89hp`, `CVE-2026-114088` · npm `trigger.dev`: affected `<4.5.4`, fixed in `4.5.4` · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control
- [Armatura LLC Armatura One Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2026-94591.md)
  `CVE-2026-94591` · CVE record: Armatura LLC Armatura One and 1 more · CVSS 8.6 High · Not analysed yet · Published 2 Oct 2026 · Tags: Hard-coded credentials
- [Armatura LLC Armatura One Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-94592.md)
  `CVE-2026-94592` · CVE record: Armatura LLC Armatura One and 1 more · CVSS 8.6 High · Not analysed yet · Published 2 Oct 2026 · Tags: Hard-coded credentials
- [Monta monta.app Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-93474.md)
  `CVE-2026-93474` · CVE record: Monta monta.app · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Hard-coded credentials
- [GV-Eye Relay Payment API Key Vulnerability](https://agentprime.io/advisories/CVE-2026-103097.md)
  `CVE-2026-103097` · CVE record: GeoVision Inc. GV-Eye · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-540
- [GV-Eye Hardcoded API Key Vulnerability](https://agentprime.io/advisories/CVE-2026-103096.md)
  `CVE-2026-103096` · CVE record: GeoVision Inc. GV-Eye · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-540
- [Hard-coded credentials in Johnson Controls EasyIO FG](https://agentprime.io/advisories/CVE-2026-27873.md)
  `CVE-2026-27873` · CVE record: Johnson Controls EasyIO FG · CVSS 5.6 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Johnson Controls EasyIO FS32](https://agentprime.io/advisories/CVE-2026-71449.md)
  `CVE-2026-71449` · CVE record: Johnson Controls EasyIO FS32 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [PictShare < 3.7.1 Sensitive Information Disclosure via info API](https://agentprime.io/advisories/CVE-2026-104051.md)
  `CVE-2026-104051` · CVE record: HaschekSolutions pictshare · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Hard-coded credentials in Johnson Controls EasyIO FS32](https://agentprime.io/advisories/CVE-2026-27874.md)
  `CVE-2026-27874` · CVE record: Johnson Controls EasyIO FS32 · CVSS 5.0 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Hardcoded Passwords in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-55395.md)
  `CVE-2026-55395` · CVE record: Teledyne FLIR Aware2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Joyland AI hard-coded credentials for push notifications](https://agentprime.io/advisories/CVE-2026-102666.md)
  `CVE-2026-102666` · CVE record: Joyland Joyland.ai · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access](https://agentprime.io/advisories/CVE-2026-13043.md)
  `CVE-2026-13043` · CVE record: WatchGuard Endpoint Security · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67104.md)
  `CVE-2026-67104` · CVE record: HCL Software HCL BigFix Service Management · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook](https://agentprime.io/advisories/CVE-2026-103256.md)
  `CVE-2026-103256` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens](https://agentprime.io/advisories/CVE-2026-82827.md)
  `CVE-2026-82827` · CVE record: Hitachi Industrial Equipment Systems Hitachi Coding Software Suite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)](https://agentprime.io/advisories/CVE-2026-92537.md)
  `CVE-2026-92537` · CVE record: satollo Newsletter – Send awesome emails from WordPress · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100264.md)
  `CVE-2026-100264` · CVE record: JetBrains YouTrack · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Hard-coded credentials
- [AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle](https://agentprime.io/advisories/CVE-2026-47097.md)
  `CVE-2026-47097` · CVE record: AJA Video Systems HELO Plus · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Hard-coded credentials
- [Information disclosure in BVMS 4.5 up to 12.3](https://agentprime.io/advisories/CVE-2026-10764.md)
  `CVE-2026-10764` · CVE record: IQSIGHT BVMS · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Hard-coded credentials
- [AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret](https://agentprime.io/advisories/CVE-2026-103055.md)
  `CVE-2026-103055` · CVE record: beenuar AiSOC · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in Viidure Dashcam Android Application](https://agentprime.io/advisories/CVE-2026-96587.md)
  `CVE-2026-96587` · CVE record: Viidure Dashcam Android Application · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Use of Weak Credentials in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100299.md)
  `CVE-2026-100299` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100298.md)
  `CVE-2026-100298` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100294.md)
  `CVE-2026-100294` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Weak root password in EVbee DC 80](https://agentprime.io/advisories/CVE-2026-22094.md)
  `CVE-2026-22094` · CVE record: EVbee DC 80 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment](https://agentprime.io/advisories/CVE-2026-7193.md)
  `CVE-2026-7193` · CVE record: Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi Router · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Apache Airflow's Snowflake provider did not validate the connection's \`account\` and \`region\` fields before interpolating them into request URLs. The SQL API endpoint is built as \`https\://{account}....](https://agentprime.io/advisories/PYSEC-2026-4188.md)
  `PYSEC-2026-4188`, `CVE-2026-81930` · PyPI `apache-airflow-providers-snowflake`: affected `<6.18.0`, fixed in `6.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Netcore NAP930 Backup/Restore backup_common.sh hard-coded key](https://agentprime.io/advisories/CVE-2026-102241.md)
  `CVE-2026-102241` · CVE record: Netcore NAP930 · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials, CWE-320
- [Hard-coded password in Dell Live Optics Collector](https://agentprime.io/advisories/CVE-2026-70413.md)
  `CVE-2026-70413` · CVE record: Dell Live Optics Collector · CVSS 5.6 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Hard-coded credentials
- [Use of Shared Cryptographic Key in mH-DEVELOPER](https://agentprime.io/advisories/CVE-2026-82929.md)
  `CVE-2026-82929` · CVE record: F&F Filipowski mH-DEVELOPER · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Hard-coded credentials
- [refly-ai refly JWT Token app.config.ts hard-coded credentials](https://agentprime.io/advisories/CVE-2026-101052.md)
  `CVE-2026-101052` · CVE record: refly-ai refly · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Hard-coded credentials
- [Nezha before 2.2.7 Information Disclosure via /api/v1/profile](https://agentprime.io/advisories/CVE-2026-101089.md)
  `CVE-2026-101089` · CVE record: nezhahq nezha · CVSS 2.3 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Hard-coded credentials
- [OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override](https://agentprime.io/advisories/CVE-2026-100569.md)
  `CVE-2026-100569` · CVE record: OpenClaw OpenClaw · CVSS 6.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Hard-coded credentials
- [Cross-origin credential leak in HTTP stream wrapper redirects](https://agentprime.io/advisories/CVE-2026-91766.md)
  `CVE-2026-91766` · CVE record: PHP Group PHP · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [Zammad: Sensitive Information Exposure in Integration Administration API](https://agentprime.io/advisories/CVE-2026-63207.md)
  `CVE-2026-63207` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password](https://agentprime.io/advisories/CVE-2026-97877.md)
  `CVE-2026-97877` · CVE record: zhistaredu StarTraining · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Hard-coded credentials, CWE-255
- [Hard-coded cryptographic key in Tohoku Electric Power Company, Incorporated Tohoku Electric Power "Yorisou e… and others](https://agentprime.io/advisories/CVE-2026-75553.md)
  `CVE-2026-75553` · CVE record: Tohoku Electric Power Company, Incorporated Tohoku Electric Power "Yorisou e Net" Android App and 1 more · CVSS 2.4 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Hard-coded credentials
- [Botslab G980H Dashcams Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-79959.md)
  `CVE-2026-79959` · CVE record: Botslab G980H · CVSS 7.0 High · Not analysed yet · Published 24 Sept 2026 · Tags: Hard-coded credentials
- [Botslab G980H Dashcams Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2026-75558.md)
  `CVE-2026-75558` · CVE record: Botslab G980H · CVSS 6.0 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Hard-coded credentials
- [Botslab G980H Dashcams Use of Weak Credentials](https://agentprime.io/advisories/CVE-2026-88761.md)
  `CVE-2026-88761` · CVE record: Botslab G980H · CVSS 6.0 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in Eufy Omni C20](https://agentprime.io/advisories/CVE-2026-93290.md)
  `CVE-2026-93290` · CVE record: Eufy Omni C20 · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Hard-coded credentials
- [authentik: Stored credentials are readable with view permission alone](https://agentprime.io/advisories/CVE-2026-94611.md)
  `CVE-2026-94611` · CVE record: goauthentik authentik · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy](https://agentprime.io/advisories/CVE-2026-79762.md)
  `CVE-2026-79762` · CVE record: Termix-SSH Termix · CVSS 5.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Hard-coded credentials
- [Araxis Merge insufficiently protected credentials](https://agentprime.io/advisories/CVE-2026-92680.md)
  `CVE-2026-92680` · CVE record: Araxis Merge · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Hard-coded credentials
- [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81208.md)
  `CVE-2026-81208` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Hard-coded credentials
- [sfturing hosp_order jdbc.properties hard-coded credentials](https://agentprime.io/advisories/CVE-2026-96548.md)
  `CVE-2026-96548` · CVE record: sfturing hosp_order · CVSS 6.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Hard-coded credentials
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18181.md)
  `CVE-2026-18181` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Hard-coded credentials
- [Sensitive data exposure](https://agentprime.io/advisories/CVE-2026-86708.md)
  `CVE-2026-86708` · CVE record: Zohocorp ManageEngine Applications Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Hard-coded credentials
- [Hard-coded credentials in OpenEye Apex Network Video Recorder (NVR)](https://agentprime.io/advisories/CVE-2026-92928.md)
  `CVE-2026-92928` · CVE record: OpenEye Apex Network Video Recorder (NVR) · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18154.md)
  `CVE-2026-18154` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.0 High · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18124.md)
  `CVE-2026-18124` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-17644.md)
  `CVE-2026-17644` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-17643.md)
  `CVE-2026-17643` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH](https://agentprime.io/advisories/CVE-2026-47116.md)
  `CVE-2026-47116` · CVE record: LTSecurity LTK3500SF · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)](https://agentprime.io/advisories/CVE-2026-76708.md)
  `CVE-2026-76708` · CVE record: Hewlett Packard Enterprise (HPE) ALE · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [Hard-coded password in NVIDIA Infrastructure Controller](https://agentprime.io/advisories/CVE-2026-65117.md)
  `CVE-2026-65117` · CVE record: NVIDIA Infrastructure Controller · CVSS 5.0 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI2LTA5LTIyVDE0OjEwOjMzLjM0NjAwMFoiLCJDVkUtMjAyNi02NTExNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI2LTEwLTA1VDE4OjEyOjMzLjA2MjAwMFoiLCJDVkUtMjAyNi0xMDU2NDEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI2LTEwLTA1VDE4OjEyOjMzLjA2MjAwMFoiLCJDVkUtMjAyNi0xMDU2NDEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.