Hard-coded credentials.

OTP Bypass in Digital Operation Services' WifiBurada

• Digital Operations Services Inc. WifiBurada
• Information disclosure
• Hard-coded credentials

CODESYS Visualization - Insufficiently Protected Credentials

• CODESYS Visualization
• Hard-coded credentials

Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml

• Taiko Network Communications Pte Ltd. AG1000-01A SMS Alert Gateway
• Hard-coded credentials

Hard-coded cryptographic key in NVIDIA DGX Spark

• NVIDIA DGX Spark
• Hard-coded credentials

Use of Hard-coded Credentials in ScadaBR

• ScadaBR
• Hard-coded credentials

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

• Cross-site scripting (XSS)
• Hard-coded credentials

<26.0.0 · fixed in 26.0.0

HAXcms: Private Key Disclosure via Broken HMAC Implementation

• Information disclosure
• Hard-coded credentials

<26.0.0 · fixed in 26.0.0

Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

• Apache Software Foundation Apache OFBiz
• Hard-coded credentials

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

• Authentication bypass
• Weak cryptography or TLS

<2.10.3 || >=3.0.0, <3.2.0 · fixed in 2.10.3, 3.2.0

Mattermost doesn't prevent disclosure of created user password

• Hard-coded credentials

<5.3.2-0.20260311102650-3057ae7e83e9 · fixed in 5.3.2-0.20260311102650-3057ae7e83e9

Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key

• Sanluan PublicCMS
• Hard-coded credentials
• CWE-320

slack-go `SecretsVerifier` accepts empty signing secret without precondition

• Authentication bypass
• Weak cryptography or TLS

<0.23.1 · fixed in 0.23.1

HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication

• HCL AION
• Hard-coded credentials

FlowiseAI Exposes Basic Auth Credentials via API

• Hard-coded credentials

<3.1.2 · fixed in 3.1.2

Hardcoded credentials in Comarch ERP Optima

• Comarch ERP Optima
• Hard-coded credentials

Huawei HG630 V2 Router Authentication Bypass via Serial Number

• www.huawei.com HG630 V2 Router
• Hard-coded credentials

Hard-coded cryptographic key in ELECOM CO.,LTD. WRC-X1800GS-B and others

• ELECOM CO.,LTD. WRC-X1800GS-B
• ELECOM CO.,LTD. WRC-X3000GS2-B
• Hard-coded credentials

proxy credentials leak over redirect-to proxy

• curl
• Hard-coded credentials

Hard-coded cryptographic key in Fortinet FortiClientWindows

• Fortinet FortiClientWindows
• Hard-coded credentials

JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter

• Dragonmonk111 junoclaw
• Information disclosure
• Hard-coded credentials

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

• Information disclosure
• Hard-coded credentials

<0.1.0-alpha.4 · fixed in 0.1.0-alpha.4

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

• OALDERS LWP::UserAgent
• Hard-coded credentials

Hard-coded credentials in Siemens Teamcenter V2312 and others

• Siemens Teamcenter V2312
• Siemens Teamcenter V2406
• Hard-coded credentials

Hard-coded cryptographic key in Siemens blueplanet 100 NX3 M8 and others

• Siemens blueplanet 100 NX3 M8
• Siemens blueplanet 100 TL3 GEN2
• Hard-coded credentials

Insufficiently protected credentials in Apple macOS

• Apple macOS
• Hard-coded credentials

SOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools

• socfortress CoPilot
• Authentication bypass
• Hard-coded credentials

Meari SDK hardcoded cryptographic keys

• com.meari.sdk
• Hard-coded credentials

Hard-coded credentials in Dell ECS and others

• Dell ECS
• Dell ObjectScale
• Hard-coded credentials

Industrial Application Software IAS Canias ERP JNLP Deployment Endpoint hard-coded key

• Industrial Application Software IAS Canias ERP
• Hard-coded credentials
• CWE-320

@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

• Hard-coded credentials
• CWE-346

>=9.9.5, <12.3.3 · fixed in 12.3.3

Weak credentials vulnerability in the CashDro 3 web administration panel

• CashDro 3 Administration Panel
• Hard-coded credentials

yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).

• Hard-coded credentials

Hardcoded credentials in Yarbo robot firmware

• Yarbo Firmware
• Hard-coded credentials

fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

• Authentication bypass
• Weak cryptography or TLS

<6.2.4 · fixed in 6.2.4

PicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentials

• PicoTronica e-Clinic Healthcare System ECHS
• Hard-coded credentials

Usage of a hard-coded cryptographic key in WatchGuard Agent allows inclusion of code into existing process

• WatchGuard Agent
• Hard-coded credentials

HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability

• HCL BigFix RunBookAI
• Hard-coded credentials

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

• Zabbix
• Hard-coded credentials

gix-transport: HTTP credentials leaked to redirected host in curl backend

• Hard-coded credentials

>=0.25.4, <0.56.0 · fixed in 0.56.0

ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

• Hard-coded credentials

>=0.6.3, <0.11.1 · fixed in 0.11.1

Argo vulnerable to exposure of artifact repository credentials

• Hard-coded credentials

>=4.0.0, <4.0.5 · fixed in 4.0.5

Easy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code Scanning

• Scott Paterson easy-paypal-events-tickets
• Hard-coded credentials

D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials

• D-Link DIR-456U Firmware
• Hard-coded credentials

D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials

• D-Link DIR-600L Firmware
• Hard-coded credentials

D-Link DIR-600L B1 Hardcoded Telnet Backdoor Credentials

• D-Link DIR-600L Firmware
• Hard-coded credentials

D-Link DIR-605L B2 Hardcoded Telnet Backdoor Credentials

• D-Link DIR-605L Firmware
• Hard-coded credentials

D-Link DIR-605L A1 Hardcoded Telnet Backdoor Credentials

• D-Link DIR-605L Firmware
• Hard-coded credentials

GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi privilege escalation vulnerability via leak of Administrator credentials

• GeoVision Inc. GV-LPC2011/LPC2211
• Hard-coded credentials

My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action

• bplugins My Social Feeds – Social Feeds Embedder Plugin for WordPress
• Hard-coded credentials

AstrBot Makes Use of Hard-coded Password

• Hard-coded credentials

<=4.16.0 · no fixed version yet

Insufficiently protected credentials in Apple macOS

• Apple macOS
• Hard-coded credentials

Information Disclosure Vulnerability in e-Sushrut HMIS

• CDAC-Noida e-Sushrut, Hospital Management Information System (HMIS)
• Hard-coded credentials

Insufficiently protected credentials in Dell iDRAC10

• Dell iDRAC10
• Hard-coded credentials

WattBox 800 & 820 Series < 2.10.0.0 RCE via Diagnostic Endpoints

• Snap One, LLC WattBox 800
• Snap One, LLC WattBox 820
• Hard-coded credentials
• CWE-912

Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded key

• Xuxueli xxl-job
• Hard-coded credentials
• CWE-320

Milesight Cameras Use of Hard-coded Cryptographic Key

• Milesight MS-Cxx63-PD
• Milesight MS-Cxx64-xPD
• Hard-coded credentials

Milesight Cameras Use of Hard-coded Credentials

• Milesight MS-Cxx63-PD
• Milesight MS-Cxx64-xPD
• Hard-coded credentials

tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials

• tufantunc ssh-mcp
• Hard-coded credentials

Datavane Datavines JWT Token TokenManager.java hard-coded key

• Datavane Datavines
• Hard-coded credentials
• CWE-320

OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

• Hard-coded credentials
• CWE-15

>=2026.4.5, <2026.4.20 · fixed in 2026.4.20