9.3
Critique
CVE-2026-69102 MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in…
Description
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MaxKey 4.1 | premières → 4.1.11 | Pas de correctif indiqué |
Autres CVE de MaxKey
Les 4 CVE de MaxKey →
CVE-2026-67345
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in…
8.5
Élevée
CVE-2026-7699
A security flaw has been discovered in Dromara MaxKey up to 3.5.13
5.3
Moyenne
CVE-2025-6517
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical
5.3
Moyenne