cyfenced.com →

[ CVE-2026-120209 · Published 31 Oct 2026 ]

Vulnerability in anji-plus AJ-Report

CVSS 9.8 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.8

[ Description ]Official description

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References