CVE-2026-120209

Name of the Vulnerable Software and Affected Versions AJ-Report versions 1.0 through 1.7.1

Description The software uses a hard-coded JWT secret to sign share tokens, which enables attackers to forge valid tokens offline. By creating a token with the reportCode variable set to 'dataSet', an attacker can access the 'testTransform' endpoint. This endpoint passes scripts to the GroovyClassLoader() function, leading to unauthenticated remote code execution (RCE), a process where an attacker executes arbitrary commands on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.