CVE-2026-69102MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

Descripción

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• Product Repository product
• GitHub Issue issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/maxkey-hard-coded-jwt-secret-unauthorized-access-via-login-jwt-trust third-party-advisory