CVE-2026-69102

Received Received - Intake

MaxKey JWT Authentication Bypass via Hard-Coded Secret

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-69102

EUVD

EUVD-2026-56852

Affected Vendors & Products

Vendor	Product	Version / Range
dromara	maxkey	to 4.1.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability in MaxKey is an unauthorized access flaw caused by a hard-coded JWT signing secret in application-maxkey.properties. Attackers can forge valid JWT tokens using the known default secret and authenticate as any user via the password-skipped login endpoint. By submitting a crafted token to the /sign/login/jwt/trust endpoint, they gain full admin access to SSO configurations and downstream secrets.

Detection Guidance

Check if the hard-coded JWT secret is present in application-maxkey.properties by searching for maxkey.auth.jwt.secret. Verify if the /sign/login/jwt/trust endpoint is accessible without authentication. Inspect network traffic for JWT tokens signed with the default secret.

Impact Analysis

Unauthenticated attackers can impersonate any user, including administrators, to access sensitive SSO application configurations and modify downstream application secrets. This leads to complete system compromise, data breaches, and potential lateral movement within connected systems.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's integrity and confidentiality principles or HIPAA's access controls. Unauthorized access risks exposing personal or sensitive data, leading to regulatory penalties and loss of trust.

Mitigation Strategies

Disable JWT login by default by setting maxkey.login.jwt=false in application-maxkey.properties. Replace the hard-coded JWT secret with a unique, randomly generated value before first startup. Remove or restrict access to the /sign/login/jwt/trust endpoint.

Hi! I’m here to help you understand CVE-2026-69102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70