#Hardcoded Credentials
All CosmicBytez Labs articles tagged #Hardcoded Credentials, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105278: openPDC Docker Image Ships Hardcoded Admin Credential
A fixed admin login baked into openPDC's Docker image, with no forced change, gives network attackers full control (CVSS 9.8).
- Security
CVE-2026-96587: Viidure Dashcam Android App Hardcodes Cloud Storage Credentials
Maximum-severity CVSS 10.0 flaw: Viidure's dashcam Android app hardcodes plaintext cloud storage keys, exposing firmware and binaries to tampering.
- Security
CVE-2026-38577: Tenda HG21 Hardcoded Admin Credentials
Hardcoded admin credentials baked into Tenda HG21 firmware let attackers bypass authentication and gain full root access to the router.
- Security
Shinobi NVR: Hardcoded Child-Node Key Enables Unauthenticated Database Compromise (CVE-2026-82448)
CVE-2026-82448 (CVSS 9.8): a hardcoded key in Shinobi's child-node service lets attackers run arbitrary SQL against user and camera data.
- Security
CVE-2025-63823: My Safetipin Android App Exposes Hardcoded Credentials (CVSS 9.8)
A critical hardcoded credentials vulnerability in the My Safetipin Android app v5.2.1 allows remote attackers to bypass authentication and gain...
- Security
CVE-2026-20316: Cisco FMC Hardcoded Password Gives Unauthenticated Remote Access
A hardcoded static credential in Cisco Secure Firewall Management Center allows unauthenticated remote attackers to log in and access sensitive data. CISA...
- Security
CVE-2026-13714: Realtyna IDX Plugin Unauthenticated File Upload via Hardcoded Credentials
A critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Realtyna Organic IDX + WPL Real Estate WordPress plugin (before v5.3.0)...
- Security
CVE-2026-13446: IBM Langflow Hardcoded Credentials (CVSS 9.8)
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hardcoded credentials used for inbound authentication and internal encryption, allowing...
- Security
CVE-2026-11849: IRM-IEI Remote Management Hardcoded Credentials
A critical CVSS 9.8 hardcoded credentials vulnerability in IEI Integration Corp's IRM-IEI Remote Management software allows unauthenticated remote...
- Security
CVE-2026-35075: Hardcoded Default Password in Firmware Enables Full Device Takeover (CVSS 9.8)
A CVSS 9.8 critical vulnerability allows unauthenticated remote attackers to recover a default hardcoded password from a firmware image, granting full…
- Security
CVE-2016-20026: ZKTeco ZKBioSecurity 3.0 Hardcoded Tomcat
ZKTeco ZKBioSecurity 3.0 ships a bundled Apache Tomcat server with hardcoded credentials stored in tomcat-users.xml, granting unauthenticated attackers...