CVE-2026-69102

Critical

Description

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.

SeverityCritical

CVSS9.8

Exploit probability—

ProductMaxKey

PublishedAug 11, 2026

First seenAug 11, 2026

Weakness typeCWE-798Hard-coded credentials

How to fix

Patches

github.com/dromara/MaxKey/commit/6cda394ec111f03a06fb2eed0de74f787d68bd97

Affected products

Product	Affected versions	Fixed in
dromara MaxKey	v ≤ 4.1.11	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.