# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [OctoPrint Flask Secret Key hard-coded key](https://agentprime.io/advisories/CVE-2014-125135.md)
  `CVE-2014-125135` · CVE record: OctoPrint · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Hard-coded credentials, CWE-320
- [Hard-coded cryptographic key in Johnson Controls Kantech Entrapass](https://agentprime.io/advisories/CVE-2026-71456.md)
  `CVE-2026-71456` · CVE record: Johnson Controls Kantech Entrapass · CVSS 8.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Hard-coded credentials
- [TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure](https://agentprime.io/advisories/CVE-2026-112345.md)
  `CVE-2026-112345` · CVE record: Sciener TTLock · CVSS 8.6 High · Not analysed yet · Published 26 Oct 2026 · Tags: Hard-coded credentials
- [HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney](https://agentprime.io/advisories/EEF-CVE-2026-113440.md)
  `EEF-CVE-2026-113440`, `CVE-2026-113440` · Hex `hackney`: affected `>=2.0.0, <4.9.0`, fixed in `4.9.0` · CVSS 6.0 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Hard-coded credentials
- [Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application](https://agentprime.io/advisories/CVE-2026-110474.md)
  `CVE-2026-110474` · CVE record: CreditNirvana Agentic AI Call Centre · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: Hard-coded credentials
- [FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server](https://agentprime.io/advisories/GHSA-vqqp-x5qm-5qp4.md)
  `GHSA-vqqp-x5qm-5qp4` · PyPI `fastmcp` and 1 more: affected `>=4.0.0a1, <4.1.2`, fixed in `4.1.2` · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects](https://agentprime.io/advisories/CVE-2026-115750.md)
  `CVE-2026-115750` · CVE record: agentfront mcp-from-openapi · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Hard-coded credentials
- [Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie](https://agentprime.io/advisories/CVE-2026-54631.md)
  `CVE-2026-54631` · CVE record: Part-DB Part-DB-server · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Hard-coded credentials
- [Kiloview E3 NDI Encoder Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-92450.md)
  `CVE-2026-92450` · CVE record: Kiloview E3 Firmware · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Hard-coded credentials
- [LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints](https://agentprime.io/advisories/CVE-2026-115371.md)
  `CVE-2026-115371` · CVE record: lxc incus · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Hard-coded credentials
- [Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)](https://agentprime.io/advisories/CVE-2026-21811.md)
  `CVE-2026-21811` · CVE record: HCL Software AppScan Integration with Azure Boards for ASoC & A360 · CVSS 3.8 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Hard-coded credentials
- [NewType Infortech｜NT OneAPP - Credential Disclosure](https://agentprime.io/advisories/CVE-2026-114221.md)
  `CVE-2026-114221` · CVE record: NewType Infortech NT OneAPP · CVSS 5.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Hard-coded credentials
- [NewType Infortech｜NT OneAPP - Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-114219.md)
  `CVE-2026-114219` · CVE record: NewType Infortech NT OneAPP · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Hard-coded credentials
- [SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148](https://agentprime.io/advisories/CVE-2026-87950.md)
  `CVE-2026-87950` · CVE record: Drupal SAML SSO - Service Provider · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Hard-coded credentials
- [Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76298.md)
  `CVE-2026-76298` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [Hardcoded AES encryption key in Archer C6](https://agentprime.io/advisories/CVE-2026-89052.md)
  `CVE-2026-89052` · CVE record: TP-Link Systems Inc. Archer C6 V2 · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-103090.md)
  `CVE-2026-103090` · CVE record: Google SAM · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure](https://agentprime.io/advisories/CVE-2026-53986.md)
  `CVE-2026-53986` · CVE record: Girafit Girafit camera app · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Cisco Expressway Series Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76466.md)
  `CVE-2026-76466` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [Apache IoTDB: Legacy Pipe Privilege Escalation](https://agentprime.io/advisories/CVE-2026-59229.md)
  `CVE-2026-59229` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential](https://agentprime.io/advisories/CVE-2026-114119.md)
  `CVE-2026-114119` · CVE record: Best Practice Software Bp Premier · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records](https://agentprime.io/advisories/CVE-2026-114070.md)
  `CVE-2026-114070` · CVE record: triggerdotdev trigger.dev · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password](https://agentprime.io/advisories/CVE-2026-113736.md)
  `CVE-2026-113736` · CVE record: D-Link DHP-W610AV · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials, CWE-258
- [D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials](https://agentprime.io/advisories/CVE-2026-113735.md)
  `CVE-2026-113735` · CVE record: D-Link DCS-6501LH · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials
- [IBM Guardium Data Protection is affected by a security vulnerability](https://agentprime.io/advisories/CVE-2026-82891.md)
  `CVE-2026-82891` · CVE record: IBM Guardium Data Protection · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials
- [A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix](https://agentprime.io/advisories/GHSA-4fpj-g9jf-9rgg.md)
  `GHSA-4fpj-g9jf-9rgg`, `CVE-2026-111765` · Maven `org.a2aproject.sdk:a2a-java-sdk-http-client-android`: affected `>=1.3.0.Final, <1.3.2.Final`, fixed in `1.3.2.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials
- [A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect](https://agentprime.io/advisories/GHSA-9rhm-2h4x-jwmx.md)
  `GHSA-9rhm-2h4x-jwmx`, `CVE-2026-111763` · Maven `org.a2aproject.sdk:a2a-java-sdk-parent`: affected `<1.3.0.Final`, fixed in `1.3.0.Final` · CVSS 5.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials
- [password leak in CURLINFO_EFFECTIVE_URL](https://agentprime.io/advisories/CVE-2026-94266.md)
  `CVE-2026-94266` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials
- [ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)](https://agentprime.io/advisories/GHSA-hhph-8536-gfq5.md)
  `GHSA-hhph-8536-gfq5`, `CVE-2026-113652` · npm `uploadfs`: affected `>=1.25.0, <1.28.0`, fixed in `1.28.0` · CVSS 5.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key](https://agentprime.io/advisories/CVE-2026-113466.md)
  `CVE-2026-113466` · CVE record: MinIO · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Hard-coded credentials, CWE-320
- [IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-109126.md)
  `CVE-2026-109126` · CVE record: IBM Verify Identity Access and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Hard-coded credentials
- [agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable](https://agentprime.io/advisories/GHSA-953h-535j-jg2v.md)
  `GHSA-953h-535j-jg2v` · Go `github.com/envoyproxy/ai-gateway`: affected `>=0.4.0-rc1, <1.2.0-rc1`, fixed in `1.2.0-rc1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Oct 2026 · Tags: Hard-coded credentials, Broken access control
- [Webkul Aureus ERP UserForm.php weak password](https://agentprime.io/advisories/CVE-2026-112193.md)
  `CVE-2026-112193` · CVE record: Webkul Aureus ERP · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Hard-coded credentials
- [GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs](https://agentprime.io/advisories/CVE-2026-112303.md)
  `CVE-2026-112303` · CVE record: GDevelop GDevelop · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Hard-coded credentials
- [D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials](https://agentprime.io/advisories/CVE-2026-112146.md)
  `CVE-2026-112146` · CVE record: D-Link E15 and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Hard-coded credentials
- [LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export](https://agentprime.io/advisories/CVE-2026-112014.md)
  `CVE-2026-112014` · CVE record: netease-youdao LobsterAI · CVSS 6.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Hard-coded credentials
- [Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match](https://agentprime.io/advisories/CVE-2026-111927.md)
  `CVE-2026-111927` · CVE record: coder coder · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Hard-coded credentials
- [Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host](https://agentprime.io/advisories/CVE-2026-96626.md)
  `CVE-2026-96626` · CVE record: getarcaneapp arcane · CVSS 8.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords](https://agentprime.io/advisories/CVE-2026-111696.md)
  `CVE-2026-111696` · CVE record: shaiwz data-platform-open · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret](https://agentprime.io/advisories/CVE-2026-111692.md)
  `CVE-2026-111692` · CVE record: databufflabs databuff · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass](https://agentprime.io/advisories/CVE-2026-111690.md)
  `CVE-2026-111690` · CVE record: suyuan32 simple-admin-core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation](https://agentprime.io/advisories/CVE-2026-111642.md)
  `CVE-2026-111642` · CVE record: fastapiadmin FastapiAdmin · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret](https://agentprime.io/advisories/CVE-2026-111636.md)
  `CVE-2026-111636` · CVE record: OpenBMB StaffDeck · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key](https://agentprime.io/advisories/CVE-2026-111633.md)
  `CVE-2026-111633` · CVE record: SeriaWei ZKEACMS · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth](https://agentprime.io/advisories/CVE-2026-111612.md)
  `CVE-2026-111612` · CVE record: qaiu netdisk-fast-download · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-107617.md)
  `CVE-2026-107617` · CVE record: Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [Shared Hard-coded Root CA Private Key](https://agentprime.io/advisories/CVE-2026-109813.md)
  `CVE-2026-109813` · CVE record: Moxa AIG-302 Series · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd](https://agentprime.io/advisories/CVE-2026-111347.md)
  `CVE-2026-111347` · CVE record: opsre go-ldap-admin · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Hard-coded credentials
- [Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials](https://agentprime.io/advisories/CVE-2026-111281.md)
  `CVE-2026-111281` · CVE record: Jooan JA-A12 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Hard-coded credentials
- [EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key](https://agentprime.io/advisories/CVE-2026-105035.md)
  `CVE-2026-105035` · CVE record: EnergizeLab FirmwareUpdater · CVSS 7.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Hard-coded credentials
- [EnergizeLab AI Station Default Root Credentials with SSH Enabled](https://agentprime.io/advisories/CVE-2026-105033.md)
  `CVE-2026-105033` · CVE record: EnergizeLab AI Station firmware (RK3562) · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Hard-coded credentials
- [sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/\<pid>/cmdline](https://agentprime.io/advisories/CVE-2026-104617.md)
  `CVE-2026-104617` · CVE record: SUSE SUSE Linux Enterprise Server 16.1 and 3 more · CVSS 5.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Hard-coded credentials
- [An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface.](https://agentprime.io/advisories/CVE-2026-36436.md)
  `CVE-2026-36436` · CVE record · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Hard-coded credentials
- [Token Signing Key Allows Unauthenticated Administrative Access](https://agentprime.io/advisories/CVE-2026-108336.md)
  `CVE-2026-108336` · CVE record: Hitachi Vantara Remot Ops Agent · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials
- [FileRise: Insecure default cryptographic key fallback in manual installs](https://agentprime.io/advisories/CVE-2026-77427.md)
  `CVE-2026-77427` · CVE record: error311 FileRise · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials, CWE-1188
- [cemtan sar2html sar2html.py hard-coded credentials](https://agentprime.io/advisories/CVE-2026-110667.md)
  `CVE-2026-110667` · CVE record: cemtan sar2html · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials
- [cpp-httplib: Cookie header leaked on cross-origin redirect](https://agentprime.io/advisories/CVE-2026-102944.md)
  `CVE-2026-102944` · CVE record: yhirose cpp-httplib · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials
- [SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments](https://agentprime.io/advisories/CVE-2026-100413.md)
  `CVE-2026-100413` · CVE record: seaweedfs seaweedfs · CVSS 7.0 High · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials
- [vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil](https://agentprime.io/advisories/CVE-2026-110612.md)
  `CVE-2026-110612` · CVE record: wwwlike vlife · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Trellix Agent](https://agentprime.io/advisories/CVE-2026-107171.md)
  `CVE-2026-107171` · CVE record: Trellix Trellix Agent · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI2LTEwLTE0VDA3OjExOjA5LjIyNzAwMFoiLCJDVkUtMjAyNi0xMDcxNzEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI2LTEwLTI2VDIxOjUyOjQ1LjA1ODAwMFoiLCJDVkUtMjAyNi0xMTY3NDciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI2LTEwLTI2VDIxOjUyOjQ1LjA1ODAwMFoiLCJDVkUtMjAyNi0xMTY3NDciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.