SECURITYCRITICALCVE-2026-120209

CVE-2026-120209: AJ-Report Hard-Coded JWT Secret Enables Unauthenticated RCE

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, letting attackers forge tokens and reach a Groovy execution endpoint (CVSS 9.8).

Dylan H.

Security Team

November 1, 2026
2 min read
CVE-2026-120209: AJ-Report Hard-Coded JWT Secret Enables Unauthenticated RCE

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • AJ-Report through 1.7.1

Executive Summary

CVE-2026-120209 is a critical vulnerability (CVSS 9.8) in AJ-Report through version 1.7.1, an open-source reporting and dashboard tool. Share tokens are signed with a hard-coded JWT secret, so attackers can forge valid Share-Token values offline and reach an endpoint that passes attacker-supplied scripts to GroovyClassLoader, giving unauthenticated remote code execution.

Vulnerability Details

FieldDetails
CVECVE-2026-120209
CVSS Score9.8 (Critical)
Published2026-10-31
TypeHard-coded cryptographic key leading to code execution
Affected VersionsThrough 1.7.1
AuthenticationNone (token is forged)
Attack VectorNetwork
ImpactRemote code execution

Technical Analysis

The attack chains two weaknesses:

  1. Forgeable token. The JWT secret used to sign share tokens is embedded in the application. Anyone with the secret can mint a token offline, including one with a reportCode of dataSet.
  2. Script evaluation. With a dataSet share token, the testTransform endpoint is reachable. It hands the supplied script to GroovyClassLoader, which compiles and runs it on the server.

Since the signing secret is identical across installations, one forged token works against every unpatched, reachable instance.

Affected Environments

Any AJ-Report deployment running 1.7.1 or earlier with its HTTP interface reachable by an attacker. Report servers often sit close to databases, so RCE can expose connection credentials and the data behind dashboards.

Remediation

  1. Upgrade to a release newer than 1.7.1 once available from the project; check its releases and advisories.
  2. Restrict access to the application to trusted networks or an authenticating reverse proxy.
  3. Block the endpoint — deny requests to testTransform at the proxy if it is not needed.
  4. Rotate credentials stored in or reachable from AJ-Report (database passwords, API keys) if the service was exposed.
  5. Run with least privilege — use a restricted OS account and read-only database users for report sources.

Detection

  • Review access logs for requests to testTransform, especially from unfamiliar IP addresses.
  • Look for unexpected child processes or outbound connections from the Java process.
  • Check for new files or scheduled tasks created by the service account.

References