CVE-2026-120209

Summary

AJ-Report uses a hardcoded JWT secret to sign share tokens, enabling attackers to forge valid tokens offline and bypass authentication. With a forged token containing reportCode 'dataSet', they can invoke the testTransform endpoint, which executes arbitrary Groovy scripts unauthenticated.

Exploitability

Trivial to exploit: attackers only need to generate a JWT with the known secret and target the testTransform endpoint; no user interaction or prior access is required.

Blast radius

Full system compromise is likely — attackers gain unauthenticated remote code execution, enabling data theft, system takeover, or lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AJ-Report version 1.7.2 or later, where the hardcoded JWT secret has been replaced with a securely generated, per-instance secret.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.