CVE-2026-69102
MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.
| CWE | CWE-798 |
| Vendor | dromara |
| Product | maxkey |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for dromara maxkey
Be the first to know when new critical vulnerabilities affecting dromara maxkey are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
dromara / MaxKey
0 ≤ 4.1.11
References
github.com: https://github.com/dromara/MaxKey github.com: https://github.com/dromara/MaxKey/issues/270 github.com: https://github.com/dromara/MaxKey/commit/6cda394ec111f03a06fb2eed0de74f787d68bd97 vulncheck.com: https://www.vulncheck.com/advisories/maxkey-hard-coded-jwt-secret-unauthorized-access-via-login-jwt-trust
Credits
Lza, Fiona