{"id":"CVE-2026-120209","kind":"vulnerability","aliases":["CVE-2026-120209"],"related":[],"title":"AJ-Report: hard-coded JWT secret lets attackers run code remotely","description":"AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.","summary":"AJ-Report signs its share tokens with a hard-coded JWT secret, so anyone can forge a valid share token offline. A forged token with reportCode 'dataSet' reaches the testTransform endpoint, which passes scripts to GroovyClassLoader, giving an unauthenticated attacker remote code execution.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AJ-Report","fixed":[],"affected":"<= 1.7.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["aj-report","java","package","reporting","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Check your AJ-Report version; NVD/VulnCheck list <= 1.7.1 as affected (project repo: https://gitee.com/belief-team/report).\n- Check whether the share feature and the dataSet/testTransform endpoint are reachable from untrusted networks.\n- Older releases shipped a default jwtSecret in the configuration (the vendor's 1.4.x release notes tell you to change it); check that yours is a unique random value. Whether that alone stops this share-token forgery is not stated in the sources.\n- Upstream fix: unknown; check the Gitee issue https://gitee.com/belief-team/report/issues/IKRV6T for a patched release.","fix":null,"status":"open","published_at":"2026-10-31T18:17:09+00:00","first_seen_at":"2026-10-31T18:37:13+00:00","triaged_at":"2026-10-31T18:38:36+00:00","updated_at":"2026-10-31T18:40:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T18:38:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AJ-Report: hard-coded JWT secret lets attackers run code remotely","impact":"high","summary":"AJ-Report signs its share tokens with a hard-coded JWT secret, so anyone can forge a valid share token offline. A forged token with reportCode 'dataSet' reaches the testTransform endpoint, which passes scripts to GroovyClassLoader, giving an unauthenticated attacker remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["aj-report","java","self-hosted","reporting"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker executes code on the server","analyst_note":"Confirm the fixed version and whether a patch exists; the sources do not state one. Check NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120209.","how_to_check":"- Check the AJ-Report version in the deployed application; the sources say versions through `1.7.1` are affected\n- Look for the hard-coded JWT secret in the AJ-Report configuration or source\n- Confirm whether the testTransform endpoint is reachable from the internet","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"AJ-Report through 1.7.1 is affected because its share-token signing secret is hard-coded, so forged tokens are accepted. Any deployment reachable over the network with the testTransform endpoint exposed is at risk. Installs that do not expose the share feature or that sit behind authentication may be less exposed, but the sources do not say how far that reduces risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4149,"output_tokens":625,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists; the sources do not state one. Check NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120209.","search":"'-120209':16A,19A '-2026':15A,18A '1.7.1':81C 'access':110C 'aj':2A,21A,24B,33B,78C 'aj-report':1A,20A,23B,32B,77C 'allow':92C 'anyon':47B 'attack':10A,73B,93C,101C 'code':6A,12A,43B,75B,89C,122C 'cve':14A,17A 'dataset':60B,108C 'endpoint':64B,113C 'execut':76B,123C 'forg':49B,56B,95C 'give':70B 'groovyclassload':69B,118C 'hard':5A,42B,88C 'hard-cod':4A,41B,87C 'host':31B 'java':26B 'jwt':7A,44B,90C 'let':9A 'mint':103C 'offlin':54B,100C 'packag':27B 'pass':66B,115C 'reach':61B 'remot':13A,74B,121C 'report':3A,22A,25B,28B,34B,79C 'reportcod':59B,107C 'run':11A 'script':67B,116C 'secret':8A,45B,91C 'self':30B 'self-host':29B 'share':37B,52B,83C,98C 'share-token':97C 'sign':35B,82C 'testtransform':63B,112C 'token':38B,53B,57B,84C,99C,105C 'unauthent':72B,120C 'valid':51B,96C","nicknames":[],"mitigations":[],"who_affected":"AJ-Report (anji-plus, self-hosted reporting dashboard) up to and including 1.7.1 signs share tokens with a hard-coded JWT secret, so anyone who knows the secret can forge a token offline and, per the CVE text, reach the testTransform endpoint, which passes scripts to GroovyClassLoader, giving unauthenticated remote code execution. Any AJ-Report instance reachable over the network is the concern. Teams not running AJ-Report can skip it; no source yet names a fixed version or a setting that rules it out.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120209","severity":null,"published_at":"2026-10-31T18:17:09+00:00","modified_at":"2026-10-31T18:17:09+00:00","first_seen_at":"2026-10-31T18:37:13+00:00","fetched_at":"2026-10-31T18:37:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120209:1255","url":null,"severity":null,"published_at":"2026-10-31T18:40:50+00:00","modified_at":"2026-10-31T18:40:50+00:00","first_seen_at":"2026-10-31T18:40:50+00:00","fetched_at":"2026-10-31T18:40:50+00:00","note":"Read VulnCheck CNA advisory and NVD JSON (both rewrites of the same text; vendor Gitee issue IKRV6T and JwtUtil.java not readable). Affected <= 1.7.1; no fixed version or vendor statement found, so fix left unknown and nothing marked verified. Not known exploited, no public PoC found. Triage's 'auth-required' not-affected tag contradicts the unauthenticated description; removed."}],"documents":[{"id":34320,"url":"https://www.vulncheck.com/advisories/aj-report-through-1.7.1-authentication-bypass-leading-to-rce-via-share-token","title":"AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token (VulnCheck)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":34321,"url":"https://gitee.com/belief-team/report/blob/V1.7.1/report-core/src/main/java/com/anjiplus/template/gaea/business/util/JwtUtil.java","title":"AJ-Report V1.7.1 JwtUtil.java (referenced, not read)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}