CVE-2026-11347

Hardcoded Cryptographic Keys and Weak IV Generation in linqi

State: Published
Severity: 8.5 High
Published: Jun 5, 2026
Updated: Jun 5, 2026
Reserved: Jun 5, 2026

Description

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	linqi

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Affected Products

Product	Versions
linqilinqi GmbH	1.4.8.5 and earlierAffected

References

https://linqi.help/en/reference/security/security-advisories/#security-advisory-hardcoded-cryptographic-keys-and-weak-iv-generation-in-linqivendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.