AJ-Report: Authentication bypass with hard-coded JWT secret leading to RCE

Summary

AJ-Report signs share tokens with a hard-coded JWT secret that is present in the public source code. An unauthenticated attacker can forge valid share tokens offline, including a token with reportCode 'dataSet' that reaches the testTransform endpoint. That endpoint passes scripts to GroovyClassLoader, which allows remote code execution without credentials or user interaction.

Affected

• AJ-Report versions 0 through 1.7.1 (CVE record: <= 1.7.1)
• Fixed version: Unknown.

Fixed in

Unknown. No vendor fix or advisory was found at the time of writing.

Workaround

• Remove public internet access to AJ-Report immediately.
• Place the service behind a VPN or an authenticating reverse proxy, limited to known networks.
• Block external access to the share and testTransform endpoints at the proxy or firewall.
• Run the service with a low-privilege account and restrict its outbound network access.
• Use read-only database accounts where possible.

Exploitation

• No evidence of exploitation in the wild found.
• No public exploit in Metasploit or Exploit-DB and no public detection template found.
• Not listed in CISA KEV at the time of writing.
• The flaw is reported as simple to reproduce once understood, so the status may change quickly.

Our recommendation

• Inventory all AJ-Report instances, versions and internet exposure.
• Take exposed instances offline or restrict them to internal access now.
• Review logs for unusual requests to share and testTransform endpoints and for unexpected child processes of the Java service.
• Confirm that default credentials have been changed.
• Monitor the Gitee issue and the VulnCheck advisory for a fix; if none is available and the product cannot be isolated, consider replacing it.
• Recheck NVD and CISA KEV in a few days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Official CVE record mirror (threatint) cve.threatint.com
• VulnCheck advisory www.vulncheck.com
• OffSeq threat radar radar.offseq.com
• VulDB entry vuldb.com
• Gitee repository AJ-Report gitee.com
• JwtUtil.java at V1.7.1 gitee.com
• Gitee issue IKRV6T gitee.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:20.