Summary
generated automatically from NVD dataAJ-Report, through version 1.7.1, signs its share tokens with a hard-coded JWT secret (CWE-321), so attackers can forge valid Share-Tokens offline. A forged token carrying the reportCode 'dataSet' grants access to the testTransform endpoint, which hands scripts to GroovyClassLoader. This yields unauthenticated remote code execution over the network, and the flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.
NVD description
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.
CVSS v3.1 Score
Information
- Published
- 31 oct. 2026
- Updated
- 31 oct. 2026
- Status
- Received
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (4)
Similar CVEs
Other vulnerabilities of type CWE-321
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.