VULNERABILITY INTELLIGENCE
CVE-2026-69102
CVSS score9.3 CRITICAL
EPSS probability0.64%
CISA KEVNot currently listed
Published2026-08-11
Last modified2026-10-24
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.
Weakness classification
- CWE-798: Use of Hard-coded Credentials