Hard-coded credentials.

PROG MIS｜ERP App - Use of Hard-coded Credentials

• PROG MIS ERP App
• Hard-coded credentials

stale proxy password leak

• curl
• Hard-coded credentials

password leak with netrc and user in URL

• curl
• Hard-coded credentials

Gardyn IoT Hub Use of Hard-coded Credentials

• Gardyn Home Firmware
• Gardyn Studio Firmware
• Hard-coded credentials

WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database

• WatchGuard Fireware OS
• Hard-coded credentials

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

• Hard-coded credentials

>=0.2.21, <0.4.45 · fixed in 0.4.45

LaunchServer FileServerHandler has an unauthenticated path traversal issue

• Path traversal
• Information disclosure

<=5.7.11 · no fixed version yet

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

• Authentication bypass
• Weak cryptography or TLS

<1.6.8 · fixed in 1.6.8

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

• Information disclosure
• Hard-coded credentials

<0.0.0-20260528173546-51f1a52e170f · fixed in 0.0.0-20260528173546-51f1a52e170f

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

• Hard-coded credentials
• Server-side request forgery (SSRF)

<2026.5.2 · fixed in 2026.5.2

OpenClaw MCP SSE redirects could forward Authorization headers

• Information disclosure
• Hard-coded credentials

<2026.6.5 · fixed in 2026.6.5

ORAS Go forwards registry credentials across registry redirects

• Information disclosure
• Hard-coded credentials

<2.6.1 · fixed in 2.6.1

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

• Hard-coded credentials

>=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2 · fixed in 0.12.15, 0.13.11, 0.14.6, 0.15.2

UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access

• uvnc UltraVNC
• Hard-coded credentials

Use of Hard-coded Credentials in StoneFly Storage Concentrator

• StoneFly Storage Concentrator
• StoneFly Storage Concentrator Virtual Machine
• Hard-coded credentials

Insufficiently protected credentials in Google Chrome

• Google Chrome
• Hard-coded credentials

Weak Password Requirements in KTM System e-BOK

• KTM System e-BOK
• Hard-coded credentials

Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API

• parseable
• Hard-coded credentials

praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

• Hard-coded credentials

<0.1.4 · fixed in 0.1.4

Information exposure vulnerability in Hitachi Storage Navigator

• Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8
• Hitachi Virtual Storage Platform G1000, G1500, F1500, VX7
• Hard-coded credentials

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

• Information disclosure
• Hard-coded credentials

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

• Information disclosure
• Hard-coded credentials

<10.34.0 || >=11.0.0, <11.4.0 · fixed in 10.34.0, 11.4.0

Daktronics Controller Firmware Use of Hard-coded Credentials

• Daktronics VFC-DMP-5000
• Daktronics DMP-5000
• Hard-coded credentials

regclient may leak authentication credentials to external blob stores

• Hard-coded credentials

<0.11.5 · fixed in 0.11.5

RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

• rustfs
• Information disclosure
• Hard-coded credentials

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

• opf openproject
• Insecure deserialization
• Hard-coded credentials

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

• Hard-coded credentials
• CWE-620

<16.1.1 · fixed in 16.1.1

Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch

• dokku
• Hard-coded credentials

WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability

• Dev Kabir Enable CORS
• Hard-coded credentials

Weak credentials in Reolink Home Hub

• Reolink Home Hub
• Hard-coded credentials

Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials.

• Hard-coded credentials

Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key

• Shenzhen i365-Tech Co. Ltd. Setracker2 Parental Control App (Android) package com.tgelec.setracker
• Hard-coded credentials

EVoke Systems EVoke CSMS Insufficiently Protected Credentials

• EVoke CSMS
• Hard-coded credentials

Insufficiently protected credentials in Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit &… and others

• Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
• Schneider Electric Saitel DP Remote Terminal Unit & Controller
• Hard-coded credentials

NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass

• NetComm Wireless Pty Ltd NF20MESH
• Hard-coded credentials

motionEye's World-Readable Configuration File Exposes Admin Password Hash

• Information disclosure
• Hard-coded credentials

<0.44.0 · fixed in 0.44.0

Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system

• IBM Storage Protect Client
• IBM Storage Protect Snapshot For Windows
• Hard-coded credentials

Hard-coded credentials in bitnami/cassandra

• bitnami/cassandra
• Hard-coded credentials

Hard-coded credentials in bitnami/mariadb-galera and others

• bitnami/mariadb-galera
• bitnami/mariadb-galera Helm chart
• Hard-coded credentials

Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

• Information disclosure
• Hard-coded credentials

<1.7.53 · fixed in 1.7.53

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

• Hard-coded credentials
• CWE-1188

<0.1.6 · fixed in 0.1.6

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

• Authentication bypass
• Hard-coded credentials

<0.1.6 · fixed in 0.1.6

Hardcoded cloud credentials in Worksnaps client application binaries expose production cloud resources

• Silver Leaf Technologies, Inc. Worksnaps.net Worksnaps
• Hard-coded credentials

OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin

• Information disclosure
• Hard-coded credentials

<2026.5.12 · fixed in 2026.5.12

Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances

• Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2223-W
• Mitsubishi Electric Corporation Room Air Conditioners (for Japan) MSZ-BKR2224-W
• Hard-coded credentials

Duplicate Advisory: MCP Streamable HTTP redirects could forward configured custom headers to another origin

• Hard-coded credentials

* · no fixed version yet

Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution

• Information disclosure
• Hard-coded credentials

<0.8.8 · fixed in 0.8.8

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

• Path traversal
• Cross-site scripting (XSS)

<0.8.7 · fixed in 0.8.7

Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector

• Radiflow iSAP Smart Collector
• Hard-coded credentials

Hard-coded cryptographic key in Canon Inc. EOS Network Setting Tool for Windows and others

• Canon Inc. EOS Network Setting Tool for Windows
• Canon Inc. EOS Network Setting Tool for macOS
• Hard-coded credentials

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

• Information disclosure
• Hard-coded credentials

<3.14.1 · fixed in 3.14.1

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

• Path traversal
• Hard-coded credentials

<2.14.1 · fixed in 2.14.1

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

• Mattermost
• Hard-coded credentials

Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data

• Wertheim GmbH Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)
• Hard-coded credentials

Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption

• Wertheim GmbH Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller)
• Hard-coded credentials

Naxclow IoT Platform Use of hard-coded cryptographic key

• Naxclow Smart Doorbell X3
• Naxclow X Smart Home
• Hard-coded credentials

Aqara Home Android SDK hardcoded keys

• com.lumiunited.aqarahome
• Hard-coded credentials

Aqara hardcoded OAuth client credentials

• Aqara Aquara IAM/SSO Gateway
• Hard-coded credentials

Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials

• Yarbo Android/IOS mobile application
• Yarbo Cloud MQTT infrastructure
• Hard-coded credentials

IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials

• IEI Integration Corp iRM-TSi410X
• Hard-coded credentials