---
id: "CVE-2026-120209"
kind: "vulnerability"
aliases: ["CVE-2026-120209"]
title: "AJ-Report: hard-coded JWT secret lets attackers run code remotely"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "AJ-Report", "fixed": [], "affected": "<= 1.7.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aj-report", "java", "package", "reporting", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-31T18:17:09+00:00"
first_seen_at: "2026-10-31T18:37:13+00:00"
updated_at: "2026-10-31T18:40:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120209", "first_seen_at": "2026-10-31T18:37:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T18:40:50+00:00"}]
---

# AJ-Report: hard-coded JWT secret lets attackers run code remotely

AJ-Report signs its share tokens with a hard-coded JWT secret, so anyone can forge a valid share token offline. A forged token with reportCode 'dataSet' reaches the testTransform endpoint, which passes scripts to GroovyClassLoader, giving an unauthenticated attacker remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AJ-Report affected <= 1.7.1 fixed ?

## How to check

- Check your AJ-Report version; NVD/VulnCheck list <= 1.7.1 as affected (project repo: https://gitee.com/belief-team/report).
- Check whether the share feature and the dataSet/testTransform endpoint are reachable from untrusted networks.
- Older releases shipped a default jwtSecret in the configuration (the vendor's 1.4.x release notes tell you to change it); check that yours is a unique random value. Whether that alone stops this share-token forgery is not stated in the sources.
- Upstream fix: unknown; check the Gitee issue https://gitee.com/belief-team/report/issues/IKRV6T for a patched release.

## Timeline

- 2026-10-31T18:37:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120209
- 2026-10-31T18:40:50+00:00 analyst — Read VulnCheck CNA advisory and NVD JSON (both rewrites of the same text; vendor Gitee issue IKRV6T and JwtUtil.java not readable). Affected <= 1.7.1; no fixed version or vendor statement found, so fix left unknown and nothing marked verified. Not known exploited, no public PoC found. Triage's 'auth-required' not-affected tag contradicts the unauthenticated description; removed.

## Documents

- [advisory] AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token (VulnCheck) https://www.vulncheck.com/advisories/aj-report-through-1.7.1-authentication-bypass-leading-to-rce-via-share-token
- [describes] AJ-Report V1.7.1 JwtUtil.java (referenced, not read) https://gitee.com/belief-team/report/blob/V1.7.1/report-core/src/main/java/com/anjiplus/template/gaea/business/util/JwtUtil.java

## From the sources

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_