CWE-1394 · Authentication
Use of Default Cryptographic Key
27CVEs
SortMost likely exploited
27 CVEs with CWE-1394 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-120442Checkape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Keyxianhc · ape-volo-admin · CVSS 9.8 · 2026-11-02 | 9.8 | 1.7% | 2026-11-02 |
| CVE-2024-48956Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint resulting in remote c…No vendor recorded · CVSS 9.8 · 2024-12-09 | 9.8 | 0.9% | 2024-12-09 |
| CVE-2020-37281Gravitee API Management through 4.12.22 Default JWT Secret Authentication BypassGravitee · Gravitee API Management · CVSS 8.1 · 2026-10-14 | 8.1 | 0.9% | 2026-10-14 |
| CVE-2025-44954RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.RUCKUS · SmartZone · CVSS 9 · 2025-08-04 | 9.0 | 0.7% | 2025-08-04 |
| CVE-2024-11619macrozheng mall JWT Token default keymacrozheng · mall · CVSS 5 · 2024-11-22 | 5.0 | 0.7% | 2024-11-22 |
| CVE-2024-29037Default secret use for initial deploymentacryldata · datahub-helm · CVSS 9.1 · 2024-03-20 | 9.1 | 0.6% | 2024-03-20 |
| CVE-2023-6451Publicly Known Cryptographic Machine Key In Procura Portal ApplicationAlayaCare · Procura Portal · CVSS 8.6 · 2024-02-16 | 8.6 | 0.5% | 2024-02-16 |
| CVE-2026-119660MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Keyyincongcyincong · MuseBot · CVSS 9.8 · 2026-10-30 | 9.8 | 0.5% | 2026-10-30 |
| CVE-2025-41742Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system componentsSprecher Automation · SPRECON-E-C · CVSS 9.8 · 2025-12-02 | 9.8 | 0.5% | 2025-12-02 |
| CVE-2026-75870Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secretNo vendor recorded · CVSS 9.1 · 2026-08-22 | 9.1 | 0.5% | 2026-08-22 |
| CVE-2025-41744Sprecher Automation: SPRECON-E series has static default key material for TLS connectionsSprecher Automation · SPRECON-E-C · CVSS 9.1 · 2025-12-02 | 9.1 | 0.4% | 2025-12-02 |
| CVE-2026-85295Chartbrew: Full account takeover via JWTs accepted under default CB_SECRETchartbrew · chartbrew · CVSS 9.8 · 2026-11-06 | 9.8 | 0.4% | 2026-11-06 |
| CVE-2024-1275Vulnerability in Baxter Welch Allyn Connex Spot MonitorBaxter · Welch Allyn Connex Spot Monitor · CVSS 9.1 · 2024-05-31 | 9.1 | 0.4% | 2024-05-31 |
| CVE-2026-111367BillionMail through 4.9 Forgeable JWTs via Default Signing KeyaaPanel · BillionMail · CVSS 6.5 · 2026-10-15 | 6.5 | 0.3% | 2026-10-15 |
| CVE-2026-2215rachelos WeRSS we-mp-rss JWT auth.py default keyrachelos · WeRSS we-mp-rss · CVSS 3.7 · 2026-02-09 | 3.7 | 0.3% | 2026-02-09 |
| CVE-2026-107177Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth TokensExpressGateway · express-gateway · CVSS 5.9 · 2026-10-07 | 5.9 | 0.3% | 2026-10-07 |
| CVE-2025-55049Use of Default Cryptographic Key (CWE-1394)Baicells · NEUTRINO430 · CVSS 9.1 · 2025-09-09 | 9.1 | 0.3% | 2025-09-09 |
| CVE-2024-10748Cosmote Greece What's Up App Realm Database RealmDB.java default keyCosmote Greece · What's Up App · CVSS 2.5 · 2024-11-04 | 2.5 | 0.3% | 2024-11-04 |
| CVE-2026-54887DTLS server cookie bypass during startup window due to empty initial cookie secretErlang · OTP · CVSS 6.3 · 2026-07-02 | 6.3 | 0.3% | 2026-07-02 |
| CVE-2025-26849There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive informa…Docusnap · Docusnap · CVSS 4.3 · 2025-03-04 | 4.3 | 0.2% | 2025-03-04 |
| CVE-2025-1688System configuration password resetMilestone Systems · XProtect VMS · CVSS 5.5 · 2025-04-15 | 5.5 | 0.2% | 2025-04-15 |
| CVE-2026-92777A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary…Lenovo · Idea Tab Pro (TB373FU) · CVSS 6.4 · 2026-10-15 | 6.4 | 0.1% | 2026-10-15 |
| CVE-2026-5039Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841NTP-Link Systems Inc. · TL-WL841N v13 · CVSS 6.1 · 2026-04-23 | 6.1 | 0.1% | 2026-04-23 |
| CVE-2026-121818About Time Technologies｜Herowatch Go - Security MisconfigurationAbout Time Technologies · Herowatch Go · CVSS 7.8 · 2026-11-04 | 7.8 | 0.1% | 2026-11-04 |
| CVE-2026-20709Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Seri…Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Se… · CVSS 6.6 · 2026-04-08 | 6.6 | 0.1% | 2026-04-08 |
| CVE-2026-25815Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default…Fortinet · FortiOS · CVSS 3.2 · 2026-02-05 | 3.2 | 0.1% | 2026-02-05 |
| CVE-2026-72895A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327…Siemens · SIMATIC IPC BX-21A · CVSS 7.7 · 2026-10-13 | 7.7 | 0.1% | 2026-10-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.