Live › vulnerability › CVE-2026-120209
AJ-Report signs its share tokens with a hard-coded JWT secret, so anyone can forge a valid share token offline. A forged token with reportCode 'dataSet' reaches the testTransform endpoint, which passes scripts to GroovyClassLoader, giving an unauthenticated attacker remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
AJ-Report (anji-plus, self-hosted reporting dashboard) up to and including 1.7.1 signs share tokens with a hard-coded JWT secret, so anyone who knows the secret can forge a token offline and, per the CVE text, reach the testTransform endpoint, which passes scripts to GroovyClassLoader, giving unauthenticated remote code execution. Any AJ-Report instance reachable over the network is the concern. Teams not running AJ-Report can skip it; no source yet names a fixed version or a setting that rules it out.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AJ-Report | vendor | <= 1.7.1 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-120209")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.