Symantec Messaging Gateway contains an authentication bypass vulnerability in its password reset feature that uses weak static encryption (PBEWithMD5AndDES with hardcoded key) to protect tokens formatted as 'username:password'. An attacker can encrypt 'admin:' and pass it as the authorization parameter to gain valid administrator session access.
ByteDance's Pangle SDK, embedded in 40+ popular apps including Duolingo and BeReal, transmits sensitive device fingerprinting data (battery level, IP address, storage, IDFV) encrypted with AES-256-CBC where the encryption key and IV are embedded in every message in plaintext, making the encryption trivial to break via reverse-engineered SDK code. Additionally, a hardcoded AES key was found in the native library, shared across all SDK versions.