CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-69102 — MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT sig...

·Source: NIST NVD

Updated:

Executive Summary

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and

Analysis

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets. CVSS Score: 9.8. Published: 2026-08-11T18:18:17.587.

Indicators of Compromise (1)

CVE (1)
CVE-2026-69102
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 11, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Stripe agrees $7bn takeover of AI firm OpenRouter - Bloomberg

Payments giant Stripe has struck a $7 billion deal to acquire AI gateway keeper OpenRouter, according to Bloomberg.

Finextra
MEDIUMVulnerabilityNEW

Unleashing Hackers to Be the US Government's Bounty Hunters

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/unleashing-hackers-to-be-us-governments-bounty-hunters-image_small-9-a-32585.jpg" align=right hspace=4><b>Trump Presidential Memo a Risky Proposition for Corporations and the Internet</b><br>Even those who support a White House push to involve the private sector in offensive cyber operations against foreign online crime groups adm

Bank Info Security
HIGHVulnerabilityNEW

CISA KEV: Ray-Project Ray — Ray-Project Ray Code Injection Vulnerability

Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

CVE-2025-62593Ray-Project Ray
CISA KEV