CWE-798: Use of Hard-coded Credentials

BaseDraftExploit Likelihood: High🏆 #13 in Top 25 (2024)

The product contains hard-coded credentials, such as a password or cryptographic key.

View on MITRE
262Related CVEs
13.84Severity Score
Back to CWE Lookup

Extended Description

There are two main variations: Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect. Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.

Technical Details

Structure
Simple

Applicable To

Languages
Not Language-Specific
Platforms

🏆 CWE Top 25 Historical Ranking

2023:#18
Score: 4.57
241 CVEs
2024:#13↑5
Score: 13.84
262 CVEs
Trend:Worsening (moved down 5 ranks)

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine analysis methods around the CWE-798 trust boundary

MITRE identifies black-box testing, automated static analysis, manual source review, manual dynamic analysis, binary review as applicable detection approaches. Use them to scan source, configuration, firmware, binaries, images, test fixtures, and release artifacts for credentials or keys that are shared, immutable, or recoverable by every customer. Require a reproducible trace from the initiating input or state transition to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.

CWE-798: detection methods and operational guidanceMITRE CWE

Remove credentials and keys from compiled artifacts

Never embed passwords, access tokens, or cryptographic keys in source code or a compiled executable. Provision them at runtime through protected configuration, restrict access to the process that needs them, and make rotation possible without rebuilding the application. Review source and release artifacts for recognizable secrets because strings can often be extracted from binaries.

MSC41-C: Never hard code sensitive informationCarnegie Mellon SEI

Apply lessons from CVE-2024-28987 in SolarWinds Web Help Desk

NVD maps CVE-2024-28987 to CWE-798; a hard-coded credential could allow a remote unauthenticated user to reach internal functionality and modify data. Use the case to inspect shipped binaries and support accounts, eliminate shared vendor credentials, and verify credential rotation does not require replacing the product.

CVE-2024-28987 DetailNIST National Vulnerability Database

Track CWE-798 as #13 in the 2024 CWE Top 25

CWE-798 ranked #13 in the 2024 CWE Top 25 with a score of 13.84. Use this annual evidence to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure, exploitability, and business impact for severity decisions on individual findings.

2024 CWE Top 25 Most Dangerous Software WeaknessesMITRE CWE

Track CWE-798 as #18 in the 2023 CWE Top 25

CWE-798 ranked #18 in the 2023 CWE Top 25 with a score of 4.57. Use this annual evidence to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure, exploitability, and business impact for severity decisions on individual findings.

2023 CWE Top 25 Most Dangerous Software WeaknessesMITRE CWE

Scan the complete history and release artifacts for embedded secrets

Run secret detection across current source, full version-control history, configuration, build logs, container layers, mobile packages, firmware, and compiled strings. Validate candidate credentials in an isolated environment without accessing production data. Confirm each secret is provisioned at runtime, unique per installation or identity, least-privileged, rotatable, and removed from old artifacts after replacement.

Secrets Management Cheat SheetOWASP Foundation

Frequently Asked Questions

What is CWE-798: Use of Hard-coded Credentials?+

CWE-798: Use of Hard-coded Credentials is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product contains hard-coded credentials, such as a password or cryptographic key. There are two main variations: Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect. Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.

Is CWE-798 in the CWE Top 25 Most Dangerous Software Weaknesses?+

Yes. CWE-798 ranked #13 in the CWE Top 25 for 2024, associated with 262 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

What are the security consequences of Use of Hard-coded Credentials?+

If exploited, CWE-798 (Use of Hard-coded Credentials) it can compromise Access Control, Integrity, Confidentiality, Availability and Other, leading to outcomes such as Bypass Protection Mechanism, Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands and Other.

How do you prevent or mitigate Use of Hard-coded Credentials?+

Recommended mitigations for CWE-798 include: For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7]. In Windows environments, the Encrypted File System (EFS) may provide some protection. For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key. If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.

How is Use of Hard-coded Credentials detected?+

CWE-798 can be detected using Black Box, Automated Static Analysis, Manual Static Analysis, Manual Dynamic Analysis, Automated Static Analysis - Binary or Bytecode and Manual Static Analysis - Binary or Bytecode. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Use of Hard-coded Credentials?+

CWE-798 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Use of Hard-coded Credentials?+

MITRE documents real CVEs mapped to CWE-798, including CVE-2022-40263, CVE-2022-29953, CVE-2022-29960, CVE-2022-29964 and CVE-2022-30997. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-798 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Advertisement