A hard-coded JWT signing secret in Dromara MaxKey (versions ≤ 4.1.11) lets unauthenticated attackers forge valid tokens and take over the identity provider as any user, including administrators.
What Is It
MaxKey ships with a default JWT signing secret embedded in application-maxkey.properties. Because that secret is publicly known, an attacker can craft a JWT that MaxKey will accept as legitimately signed. Submitting the forged token to the /sign/login/jwt/trust endpoint, a password-skipped login path, yields a fully authenticated session as any chosen user.
The flaw is tracked as CWE-798 (Use of Hard-coded Credentials) and carries a CVSS v3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 score of 9.3 (Critical) was also assigned. It was disclosed by VulnCheck and published to NVD on 2026-08-11.
Why It Matters
Exploitation requires no privileges, no user interaction, and no prior credentials; just network reach to the login endpoint. The attack complexity is rated Low, and confidentiality, integrity, and availability impacts are all High.
The blast radius extends past MaxKey itself. MaxKey is a single sign-on provider, so an admin session grants access to SSO application configuration and downstream application secrets. Compromising the IdP is effectively a pivot into every application that trusts it.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog in the supplied data, so there is no confirmation of active exploitation at this time.
What's Vulnerable
- Vendor: dromara
- Product: MaxKey
- Affected versions: all versions up to and including 4.1.11 (default status: affected)
Patch Status
A fix commit exists upstream in the MaxKey repository (6cda394), and the issue is tracked publicly as GitHub issue #270. Operators running 4.1.11 or earlier should upgrade to a build containing that commit and rotate the JWT signing secret to a unique, non-default value; a patch alone does not invalidate tokens forged against the known secret if the old key remains in use. No CISA-mandated remediation deadline applies, since the CVE is not in the KEV catalog per the supplied data.
Sources
- NVD, CVE-2026-69102: https://nvd.nist.gov/vuln/detail/CVE-2026-69102
- VulnCheck Advisory; MaxKey Hard-Coded JWT Secret: https://www.vulncheck.com/advisories/maxkey-hard-coded-jwt-secret-unauthorized-access-via-login-jwt-trust
- MaxKey Repository: https://github.com/dromara/MaxKey
- Fix Commit: https://github.com/dromara/MaxKey/commit/6cda394ec111f03a06fb2eed0de74f787d68bd97
- GitHub Issue #270: https://github.com/dromara/MaxKey/issues/270