9.3
Critical
CVE-2026-69102 MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in…
Description
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MaxKey 4.1 | earliest → 4.1.11 | No fix stated |
Other CVEs of MaxKey
The 4 CVEs of MaxKey →
CVE-2026-67345
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in…
8.5
High
CVE-2026-7699
A security flaw has been discovered in Dromara MaxKey up to 3.5.13
5.3
Medium
CVE-2025-6517
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical
5.3
Medium