CVE-2026-69102

Name of the Vulnerable Software and Affected Versions MaxKey (affected versions not specified)

Description An unauthorized access issue exists due to a hard-coded JWT signing secret within the application-maxkey.properties file. This allows unauthenticated attackers to forge valid JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—and authenticate as any user. By utilizing the password-skipped login mechanism, attackers can sign a token with the default secret and submit it to the /sign/login/jwt/trust endpoint to obtain an authenticated administrator session, granting access to SSO application configurations and downstream application secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.