CVE-2026-120209 Details

A vulnerability in AJ-Report versions through 1.7.1 allows for authentication bypass, leading to unauthorized remote code execution. This issue arises because the application uses a hard-coded JWT secret to sign share tokens. Attackers can exploit this by forging valid tokens offline. By minting a token with a specific report code, they can access an endpoint that executes scripts using Groovy's class loader, bypassing authentication entirely.

It is recommended to remove the hard-coded JWT secret from the source code and replace it with a securely generated random value that can be configured externally and rotated. Additionally, share tokens should be restricted to read-only report interfaces with precise path matching, and data transformation endpoints like 'testTransform' should implement separate authentication checks. Finally, any Groovy code execution should be sandboxed or whitelisted to prevent the loading of arbitrary classes.