Description

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-11T18:18:17.587Z",
  "pubdate": "2026-08-11T18:18:17.587Z",
  "executiveSummary": "MaxKey suffers from an unauthorized access vulnerability stemming from a hard-coded JSON Web Token (JWT) signing secret located within the application-maxkey.properties configuration file. This critical security flaw allows unauthenticated threat actors to independently forge valid cryptographic JWT tokens and successfully authenticate as arbitrary users, including high-privilege administrators, by leveraging the password-skipped login functionality.\nThe primary impact of this vulnerability involves total administrative session compromise, enabling attackers to bypass standard authentication controls entirely without requiring prior credentials. Successful exploitation grants complete access to Single Sign-On (SSO) application configurations and sensitive downstream application secrets managed within the MaxKey environment.\nThe affected system is MaxKey utilizing default application configurations. Risk implications are severe, as the presence of a publicly exposed or easily discoverable cryptographic signing key completely undermines the integrity and confidentiality of token-based authentication mechanisms across the deployment.\nAttacker capabilities include arbitrary identity impersonation and session hijacking over network interfaces exposed to the vulnerable endpoints. Exploitation requirements are minimal, demanding only network access to the target instance and knowledge of the publicly known default signing secret to construct cryptographically valid payloads.",
  "technicalDetails": "The root cause of the vulnerability resides in the static definition of a cryptographic signing secret used for JWT generation and validation within the application-maxkey.properties file of MaxKey. Because this secret key is hard-coded and distributed publicly as part of the default application configuration, it lacks the entropy and uniqueness required for secure cryptographic operations.\nThe vulnerable component comprises the token validation mechanism paired with the password-skipped login endpoint located at /sign/login/jwt/trust. This endpoint is designed to ingest and process trusted external authentication tokens without enforcing standard user credential verification steps.\nAuthentication requirements for initiating the attack are nonexistent, as the vulnerability exposes an unauthenticated attack surface. Privilege requirements prior to exploitation are zero, while post-exploitation privileges elevate immediately to those of the targeted user, up to and including full administrator rights.\nThe exploitation method follows a precise attack flow. First, an unauthenticated attacker identifies the target MaxKey instance and extracts or references the publicly known default JWT signing secret associated with application-maxkey.properties. Next, the attacker crafts a malicious JWT payload containing custom claims, specifically targeting administrative user identities or arbitrary accounts of interest.\nThe attacker signs the forged JWT using the retrieved hard-coded secret key, ensuring that the cryptographic signature verification succeeds when processed by the server. Subsequently, the attacker submits this crafted JWT token to the vulnerable /sign/login/jwt/trust endpoint over the network.\nUpon receiving the payload, the MaxKey application validates the signature against the hard-coded secret. Because the signature matches the server's expectation, the application treats the token as authentic and bypasses password verification due to the endpoint's design. This action results in the generation of a fully authenticated administrative session.\nThe post-exploitation impact allows the adversary to interact with the MaxKey management interface with elevated privileges. This access facilitates the enumeration and modification of SSO application configurations, extraction of downstream application secrets, and potential lateral movement into integrated enterprise services."
}