AJ-Report CVE-2026-120209

Exploitation requires only that the target runs AJ-Report at or below version 1.7.1 and is network-reachable; no authentication, credentials, or user interaction are needed because the JWT signing secret is hard-coded in JwtUtil.java and therefore identical across all installations, letting the attacker forge Share-Tokens offline. The specific prerequisites are: the ability to reach the HTTP interface, a forged Share-Token whose reportCode is set to 'dataSet', and reachability of the testTransform endpoint, which hands script content to GroovyClassLoader. The main limiting factor is network exposure - an instance restricted to an internal/trusted network is only reachable by attackers with that access - and the version ceiling (≤1.7.1); no fixed version is stated in the available sources, so the only confirmed exposure boundary is the affected-version range.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full impact to confidentiality, integrity and availability, and this is coherent with the described mechanism: a hard-coded JWT secret (CWE-321) lets an attacker forge valid Share-Tokens entirely offline, bypass authentication, and reach a Groovy-backed endpoint for remote code execution. The vuln.today decision label is 'act_now', which aligns with the unauthenticated-RCE profile and the fact that the flaw was reported by VulnCheck with a dedicated advisory. No EPSS score, no CISA KEV listing, and no confirmed public exploit-code signal are present in the supplied data, so exploitation-probability and in-the-wild signals cannot be corroborated here; the urgency therefore rests on the intrinsic severity and the detailed public description of the mechanism rather than on observed exploitation. Because the secret is hard-coded in the source (JwtUtil.java is referenced directly), every unpatched deployment shares the same forgeable key, which makes the barrier to weaponization very low once the secret value is known.

An attacker locates an internet-exposed AJ-Report instance (version ≤1.7.1), uses the hard-coded JWT secret to mint a valid Share-Token carrying reportCode 'dataSet', and submits it to the testTransform endpoint. Because testTransform passes attacker-supplied script content to GroovyClassLoader, the attacker achieves unauthenticated remote code execution on the server with no user interaction. No confirmed working exploit code is identified in the supplied data, though VulnCheck's advisory and the Gitee issue document the technique.