CVE-2026-120209 is a critical flaw in AJ-Report through version 1.7.1: a hard-coded JWT secret lets attackers forge share tokens and run code remotely without authentication.
What Is It
AJ-Report through 1.7.1 signs its share tokens with a hard-coded JWT secret, so an attacker can forge valid Share-Tokens offline. VulnCheck disclosed the issue, and it is classified as CWE-321 (Use of Hard-coded Cryptographic Key).
The attack works in three steps:
- The attacker forges a Share-Token using the hard-coded secret.
- The attacker mints the token with
reportCodeset todataSet, which gives access to thetestTransformendpoint. testTransformpasses the attacker's scripts toGroovyClassLoader, which results in unauthenticated remote code execution.
VulnCheck's advisory calls the issue an authentication bypass that leads to RCE via the share token.
Why It Matters
- CVSS 3.1: 9.8 (CRITICAL). Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0: 9.3 (CRITICAL)
The attack works over the network, has low complexity, and needs no privileges or user interaction. A successful attack has high impact on confidentiality, integrity and availability. Because the attacker can create the token offline, they don't need any credentials before attacking an exposed instance.
Exploitation status: CISA has not added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, and active exploitation has not been publicly confirmed. The NVD record was published on 2026-10-31 with status "Received", so NVD has not yet analyzed it.
What's Vulnerable
- Vendor: anji-plus
- Product: AJ-Report
- Affected versions: 0 through 1.7.1 inclusive (semver). Versions outside this range are listed as unaffected by default.
- Vulnerable component:
JwtUtil.javainreport-core, which holds the hard-coded JWT secret, plus thetestTransformendpoint. - Source repository: gitee.com/belief-team/report
Patch Status
Neither NVD nor CISA currently names a fixed version or patch. Because the CVE is not in the KEV catalog, there is no CISA required action or due date. All versions through 1.7.1 are affected. Defenders running AJ-Report should check the vendor repository, the linked Gitee issue (IKRV6T) and the VulnCheck advisory for remediation guidance.