CVE-2026-69102 in MaxKey
Summary
by MITRE • 08/11/2026
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in MaxKey represents a critical authorization flaw that stems from improper security configuration practices within the application's authentication mechanism. This issue manifests through a hard-coded JWT signing secret stored in the application-maxkey.properties configuration file, which violates fundamental security principles of secret management and credential protection. The presence of a default, publicly known secret creates an inherent weakness that directly undermines the integrity of the entire authentication system.
The technical exploitation of this vulnerability occurs through a specific attack vector targeting the password-skipped login endpoint within the application's authentication framework. This endpoint, designed to facilitate trusted authentication flows, becomes a critical attack surface when combined with the hard-coded signing secret. Attackers can easily construct valid JWT tokens using the known default secret and submit these forged tokens to the /sign/login/jwt/trust endpoint, effectively bypassing normal authentication mechanisms entirely.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as successful exploitation grants attackers full administrative privileges within the MaxKey application. This elevated access level provides comprehensive control over Single Sign-On application configurations, including the ability to modify authentication settings, manage user accounts, and potentially access sensitive downstream application secrets that depend on the SSO infrastructure. The privilege escalation aspect of this vulnerability makes it particularly dangerous in enterprise environments where MaxKey typically serves as a central authentication hub.
This vulnerability aligns with CWE-798, which specifically addresses the use of hard-coded credentials, and represents a clear violation of the principle of least privilege in security architecture. From an ATT&CK framework perspective, this weakness maps to T1078.004, which covers valid accounts used for unauthorized access, and T1566, covering spearphishing with a malicious attachment or link that could potentially exploit such configuration flaws. The attack requires minimal sophistication beyond basic understanding of JWT token structure and the application's authentication flow.
Mitigation strategies should focus on immediate secret rotation and configuration hardening practices. Organizations must replace the hard-coded default JWT signing secret with a randomly generated, securely stored value that is properly managed through established secret management systems. Implementation of proper access controls for configuration files and regular security audits of application properties are essential to prevent recurrence of such issues. Additionally, disabling or restricting access to password-skipped login endpoints should be considered when they are not strictly required for legitimate business operations.