CVE-2026-120209 — Unauthenticated RCE in AJ-Report via hard-coded JWT secret

50/100

AJ-Report versions up to 1.7.1 use a hard-coded JWT secret, allowing attackers to forge tokens and achieve unauthenticated remote code execution via the GroovyClassLoader.

• CVSS 9.3
• CWE-321

Digest of 2026-11-01

Sources

• NVD — critical CVEs (CVSS ≥ 9) — CVE-2026-120209 (CVSS 9.3)