CVE-2025-66454: Hardcoded Secret Default Or Fallback
A hardcoded default value is provided for a secret. This exposes the application to authentication bypass if a custom secret is not configured, as attackers can forge valid tokens or credentials using the known default value. Ensure that secrets default to None or securely generated values, and enforce that they are explicitly configured in production.
Pythongreprules fetch cve-2025-66454-hardcoded-secret-default-or-fallback --engine opengrepDescription
A hardcoded default value is provided for a secret. This exposes the application to authentication bypass if a custom secret is not configured, as attackers can forge valid tokens or credentials using the known default value. Ensure that secrets default to None or securely generated values, and enforce that they are explicitly configured in production.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.