CVE-2026-120209
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Oct 31, 2026
CISA due date
—
The record
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-82154 Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic… CWE-321
- CVE-2026-61737 ng-antd-admin is an Angular and NestJS administration system template. CWE-321
- CVE-2026-91912 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded… CWE-321
- CVE-2026-119597 OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that… CWE-321
- CVE-2025-62841 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
- CVE-2025-62839 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
- CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-321
- CVE-2026-102812 A hard-coded cryptographic key vulnerability exists in the user-configuration backup… CWE-321