What is Use of Hard-coded Password (CWE-259)?

TL;DR: Use of Hard-coded Password (CWE-259) occurs when a product contains a hard-coded password. To fix it, store passwords outside of the code in a strongly-protected, encrypted configuration file or database.

At-a-Glance

What is Use of Hard-coded Password?

Use of Hard-coded Password (CWE-259) is a type of authentication failure that occurs when a product contains a hard-coded password. As defined by the MITRE Corporation under CWE-259, and classified by the OWASP Foundation under A07:2025 - Authentication Failures, this vulnerability occurs when a product uses a hard-coded password for its own inbound authentication or for outbound communication to external components.

Quick Summary

Use of Hard-coded Password (CWE-259) is a critical security vulnerability that can lead to significant authentication failures. If a hard-coded password is used, malicious users can gain access through the account in question. To prevent this vulnerability, store passwords outside of the code in a strongly-protected, encrypted configuration file or database.

Jump to: What is Use of Hard-coded Password? · Quick Summary · Use of Hard-coded Password Overview · How Use of Hard-coded Password Works · Business Impact of Use of Hard-coded Password · Use of Hard-coded Password Attack Scenario · How to Detect Use of Hard-coded Password · How to Fix Use of Hard-coded Password · Framework-Specific Fixes for Use of Hard-coded Password · How to Ask AI to Check Your Code for Use of Hard-coded Password · Use of Hard-coded Password Best Practices Checklist · Use of Hard-coded Password FAQ · Vulnerabilities Related to Use of Hard-coded Password · References · Scan Your Own Site

Use of Hard-coded Password Overview

What: Use of Hard-coded Password (CWE-259) is a type of authentication failure that occurs when a product contains a hard-coded password.

Why it matters: If a hard-coded password is used, malicious users can gain access through the account in question. A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect.

Where it occurs: Use of Hard-coded Password (CWE-259) can occur in any product that uses a hard-coded password for its own inbound authentication or for outbound communication to external components.

Who is affected: Any user who has access to the product’s authentication mechanisms may be affected by this vulnerability.

Who is NOT affected: Users who do not have access to the product’s authentication mechanisms are not affected by this vulnerability.

How Use of Hard-coded Password Works

Root Cause

Use of Hard-coded Password (CWE-259) occurs when a product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack Flow

1. An attacker discovers the hard-coded password.
2. The attacker uses the hard-coded password to gain access through the account in question.
3. The attacker may then use their newfound access to perform malicious actions.

Prerequisites to Exploit

• The product must contain a hard-coded password.
• The attacker must discover the hard-coded password.
• The attacker must have access to the product’s authentication mechanisms.

Vulnerable Code

password = "mysecretpassword"

This code demonstrates a vulnerable use of a hard-coded password. In this example, the password is hardcoded directly into the code.

Secure Code

import os
from cryptography.fernet import Fernet

# Generate a secret key
key = Fernet.generate_key()

# Create a Fernet object with the secret key
cipher_suite = Fernet(key)

# Encrypt the password using the Fernet object
encrypted_password = cipher_suite.encrypt("mysecretpassword".encode())

# Store the encrypted password securely
with open("password.txt", "wb") as f:
    f.write(encrypted_password)

This code demonstrates a secure way to store a password. In this example, the password is encrypted using the Fernet library and stored securely.

Business Impact of Use of Hard-coded Password

Confidentiality: If a hard-coded password is used, malicious users can gain access through the account in question, potentially leading to unauthorized access to sensitive data.

Integrity: A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect. This can lead to integrity issues if the attacker is able to modify or delete sensitive data.

Availability: If a hard-coded password is used, malicious users can gain access through the account in question, potentially leading to denial-of-service attacks or other availability issues.

Use of Hard-coded Password Attack Scenario

1. An attacker discovers the hard-coded password.
2. The attacker uses the hard-coded password to gain access through the account in question.
3. The attacker may then use their newfound access to perform malicious actions.

How to Detect Use of Hard-coded Password

Manual Testing

• Review the product’s code for any hardcoded passwords.
• Test the product’s authentication mechanisms to ensure they are functioning correctly.

Automated Scanners (SAST / DAST)

• Use a static analysis tool to scan the product’s code for any hardcoded passwords.
• Use a dynamic analysis tool to test the product’s authentication mechanisms.

PenScan Detection

PenScan’s scanner engines actively test for this issue. Scan your own website using PenScan to find Use of Hard-coded Password and other risks before an attacker does.

False Positive Guidance

When reviewing the results of automated scanners, be sure to verify that any reported issues are not false positives. In some cases, a hardcoded password may be used for legitimate purposes, such as in a testing environment.

How to Fix Use of Hard-coded Password

• Store passwords outside of the code in a strongly-protected, encrypted configuration file or database.
• Ensure that all passwords are generated randomly and stored securely.

Framework-Specific Fixes for Use of Hard-coded Password

Python/Django

import os
from cryptography.fernet import Fernet

# Generate a secret key
key = Fernet.generate_key()

# Create a Fernet object with the secret key
cipher_suite = Fernet(key)

# Encrypt the password using the Fernet object
encrypted_password = cipher_suite.encrypt("mysecretpassword".encode())

# Store the encrypted password securely
with open("password.txt", "wb") as f:
    f.write(encrypted_password)

Java

import java.security.SecureRandom;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

// Generate a secret key
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32];
random.nextBytes(keyBytes);
String key = bytesToHex(keyBytes);

// Create a Cipher object with the secret key
Cipher cipher = Cipher.getInstance("AES");
SecretKeySpec keySpec = new SecretKeySpec(keyBytes, "AES");
cipher.init(Cipher.ENCRYPT_MODE, keySpec);

// Encrypt the password using the Cipher object
byte[] encryptedPassword = cipher.doFinal("mysecretpassword".getBytes());

// Store the encrypted password securely
FileOutputStream fos = new FileOutputStream("password.txt");
fos.write(encryptedPassword);
fos.close();

Node.js

const crypto = require('crypto');

// Generate a secret key
const key = crypto.randomBytes(32).toString('hex');

// Create a Cipher object with the secret key
const cipher = crypto.createCipher('aes-256-cbc', key);

// Encrypt the password using the Cipher object
let encryptedPassword = cipher.update("mysecretpassword", 'utf8', 'hex');
encryptedPassword += cipher.final('hex');

// Store the encrypted password securely
fs.writeFileSync("password.txt", encryptedPassword);

How to Ask AI to Check Your Code for Use of Hard-coded Password

To ask an AI coding assistant to check your code for potential CWE-259 Use of Hard-coded Password vulnerabilities, you can use the following prompt:

Review the following Python/Django code block for potential CWE-259 Use of Hard-coded Password vulnerabilities and rewrite it using secure password storage:

password = "mysecretpassword"

Use of Hard-coded Password Best Practices Checklist

✅ Store passwords outside of the code in a strongly-protected, encrypted configuration file or database. ✅ Ensure that all passwords are generated randomly and stored securely.

Use of Hard-coded Password FAQ

How does Use of Hard-coded Password occur?

Use of Hard-coded Password (CWE-259) occurs when a product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

What are the consequences of not fixing Use of Hard-coded Password?

If a hard-coded password is used, malicious users can gain access through the account in question. A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect.

How do I prevent Use of Hard-coded Password?

To prevent Use of Hard-coded Password, store passwords outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders.

Can I use encryption to protect my password file?

Yes, you can use encryption to protect your password file. However, if you cannot use encryption, make sure that the permissions are as restrictive as possible.

How do I detect Use of Hard-coded Password in my code?

You can detect Use of Hard-coded Password by using static analysis tools or manual testing.

What is the best way to fix Use of Hard-coded Password?

The best way to fix Use of Hard-coded Password is to store passwords outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders.

Can I use PenScan’s scanner engines to detect and fix Use of Hard-coded Password?

Yes, you can use PenScan’s scanner engines to detect and fix Use of Hard-coded Password.

Vulnerabilities Related to Use of Hard-coded Password

References

• MITRE CWE-259
• OWASP A07:2025 - Authentication Failures
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Hard-coded Password and other risks before an attacker does.