Authentication Bypass in AJ-Report Affected by Hard-Coded JWT Secret
CVE-2026-120209

9.3CRITICAL

Key Information:

Vendor

Anji-plus

Status
Aj-report
Vendor
CVE Published:
31 October 2026

What is CVE-2026-120209?

AJ-Report versions up to 1.7.1 are vulnerable due to a hard-coded JWT secret that allows attackers to create valid Share-Tokens without authentication. This weakness occurs when attackers mint tokens with reportCode 'dataSet', granting them access to the testTransform endpoint. This endpoint can pass scripts to GroovyClassLoader, enabling unauthenticated remote code execution, which poses significant risks to the application and its data.

Affected Version(s)

AJ-Report 0 <= 1.7.1

References

https://gitee.com/belief-team/report/issues/IKRV6T
issue-tracking
https://gitee.com/belief-team/report/blob/V1.7.1/report-c...
technical-description
https://gitee.com/belief-team/report
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LionTree
.