What’s Vulnerable › Vulnerabilities

CVE-2026-120209: AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• Public exploit or detection template: none known
• Published: 2026-10-31 · updated 2026-10-31
• Weakness: CWE-321

Description

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

Summary

AJ-Report through 1.7.1 uses a hard-coded JWT secret to sign share tokens, so attackers can forge valid Share-Tokens offline. A forged token with reportCode 'dataSet' grants access to the testTransform endpoint, which passes scripts to GroovyClassLoader and enables unauthenticated remote code execution. Rated CVSS 9.8 critical; it is not listed in CISA KEV, and no in-the-wild exploitation is confirmed by the provided facts. Upgrade AJ-Report beyond 1.7.1 to a fixed release, or restrict access to the testTransform endpoint and rotate the JWT secret as mitigation.

يستخدم AJ-Report حتى الإصدار 1.7.1 سرّ JWT مضمّنًا في الشيفرة لتوقيع رموز المشاركة، ما يسمح للمهاجمين بتزوير Share-Tokens صالحة دون اتصال. ويمنح الرمز المزوّر الذي يحمل reportCode 'dataSet' وصولًا إلى نقطة النهاية testTransform، التي تمرّر السكربتات إلى GroovyClassLoader وتتيح تنفيذ تعليمات برمجية عن بُعد دون مصادقة. التقييم 9.8 (حرج)، ولا يرد ضمن CISA KEV، ولا تؤكد المعطيات المتاحة استغلاله فعليًا. يُنصح بالترقية إلى إصدار أحدث من 1.7.1، أو تقييد الوصول إلى testTransform وتدوير سرّ JWT كإجراء تخفيفي.

Affected products

• anji-plus AJ-Report: through 1.7.1

References

• https://gitee.com/belief-team/report
• https://gitee.com/belief-team/report/blob/V1.7.1/report-core/src/main/java/com/anjiplus/template/gaea/business/util/JwtUtil.java
• https://gitee.com/belief-team/report/issues/IKRV6T
• https://www.vulncheck.com/advisories/aj-report-through-1.7.1-authentication-bypass-leading-to-rce-via-share-token

Get alerted when CVE-2026-120209 or the next vulnerability affects your stack