Hard-coded credentials.

OctoPrint Flask Secret Key hard-coded key

• OctoPrint
• Hard-coded credentials
• CWE-320

Hard-coded cryptographic key in Johnson Controls Kantech Entrapass

• Johnson Controls Kantech Entrapass
• Hard-coded credentials

TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

• Sciener TTLock
• Hard-coded credentials

HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

• Hard-coded credentials

>=2.0.0, <4.9.0 · fixed in 4.9.0

Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

• CreditNirvana Agentic AI Call Centre
• Hard-coded credentials

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

• Authentication bypass
• Hard-coded credentials

>=4.0.0a1, <4.1.2 · fixed in 4.1.2

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects

• agentfront mcp-from-openapi
• Hard-coded credentials

Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

• Part-DB-server
• Hard-coded credentials

Kiloview E3 NDI Encoder Use of Hard-coded Credentials

• Kiloview E3 Firmware
• Hard-coded credentials

LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

• lxc incus
• Hard-coded credentials

Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

• HCL Software AppScan Integration with Azure Boards for ASoC & A360
• Hard-coded credentials

NewType Infortech｜NT OneAPP - Credential Disclosure

• NewType Infortech NT OneAPP
• Hard-coded credentials

NewType Infortech｜NT OneAPP - Hard-coded Credentials

• NewType Infortech NT OneAPP
• Hard-coded credentials

SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

• Drupal SAML SSO - Service Provider
• Hard-coded credentials

Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

• Splunk Enterprise
• Hard-coded credentials

Hardcoded AES encryption key in Archer C6

• TP-Link Systems Inc. Archer C6 V2
• Hard-coded credentials

Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)

• Google SAM
• Authentication bypass
• Hard-coded credentials

Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

• Girafit camera app
• Weak cryptography or TLS
• Hard-coded credentials

Cisco Expressway Series Remote Code Execution Vulnerability

• Cisco TelePresence Video Communication Server (VCS) Expressway
• Hard-coded credentials

Apache IoTDB: Legacy Pipe Privilege Escalation

• Apache Software Foundation Apache IoTDB
• Hard-coded credentials

Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential

• Best Practice Software Bp Premier
• Hard-coded credentials

Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

• triggerdotdev trigger.dev
• Hard-coded credentials

D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password

• D-Link DHP-W610AV
• Hard-coded credentials
• CWE-258

D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials

• D-Link DCS-6501LH
• Hard-coded credentials

IBM Guardium Data Protection is affected by a security vulnerability

• IBM Guardium Data Protection
• Hard-coded credentials

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

• Hard-coded credentials

>=1.3.0.Final, <1.3.2.Final · fixed in 1.3.2.Final

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

• Hard-coded credentials

<1.3.0.Final · fixed in 1.3.0.Final

password leak in CURLINFO_EFFECTIVE_URL

• curl
• Hard-coded credentials

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

• Information disclosure
• Hard-coded credentials

>=1.25.0, <1.28.0 · fixed in 1.28.0

MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

• MinIO
• Hard-coded credentials
• CWE-320

IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials

• IBM Verify Identity Access
• IBM Security Verify Access
• Hard-coded credentials

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

• Hard-coded credentials
• Broken access control

>=0.4.0-rc1, <1.2.0-rc1 · fixed in 1.2.0-rc1

Webkul Aureus ERP UserForm.php weak password

• Webkul Aureus ERP
• Hard-coded credentials

GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

• GDevelop
• Hard-coded credentials

D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials

• D-Link E15
• D-Link M32
• Hard-coded credentials

LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

• netease-youdao LobsterAI
• Hard-coded credentials

Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

• coder
• Hard-coded credentials

Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host

• arcane
• Information disclosure
• Hard-coded credentials

data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords

• shaiwz data-platform-open
• Hard-coded credentials

DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

• databuff
• Hard-coded credentials

Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

• suyuan32 simple-admin-core
• Hard-coded credentials

FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation

• FastapiAdmin
• Hard-coded credentials

OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

• OpenBMB StaffDeck
• Hard-coded credentials

ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key

• SeriaWei ZKEACMS
• Hard-coded credentials

netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth

• qaiu netdisk-fast-download
• Hard-coded credentials

Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials

• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App
• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware
• Hard-coded credentials

Shared Hard-coded Root CA Private Key

• Moxa AIG-302 Series
• Hard-coded credentials

go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

• opsre go-ldap-admin
• Hard-coded credentials

Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials

• Jooan JA-A12
• Hard-coded credentials

EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key

• EnergizeLab FirmwareUpdater
• Hard-coded credentials

EnergizeLab AI Station Default Root Credentials with SSH Enabled

• EnergizeLab AI Station firmware (RK3562)
• Hard-coded credentials

sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline

• SUSE Linux Enterprise Server 16.1
• SUSE Linux Enterprise Server for NVIDIA 16.1
• Hard-coded credentials

An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface.

• Hard-coded credentials

Token Signing Key Allows Unauthenticated Administrative Access

• Hitachi Vantara Remot Ops Agent
• Hard-coded credentials

FileRise: Insecure default cryptographic key fallback in manual installs

• error311 FileRise
• Hard-coded credentials
• CWE-1188

cemtan sar2html sar2html.py hard-coded credentials

• cemtan sar2html
• Hard-coded credentials

cpp-httplib: Cookie header leaked on cross-origin redirect

• yhirose cpp-httplib
• Hard-coded credentials

SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

• seaweedfs
• Hard-coded credentials

vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil

• wwwlike vlife
• Hard-coded credentials

Hard-coded cryptographic key in Trellix Agent

• Trellix Agent
• Hard-coded credentials