MaxKey Unauthorized Access via Hard-coded JWT Signing Secret

MaxKey contains an unauthorized access vulnerability (CVE-2026-69102) stemming from a hard-coded JWT signing secret within the 'application-maxkey.properties' file. This flaw permits unauthenticated attackers to forge valid JWT tokens, allowing them to bypass traditional authentication mechanisms. By submitting a forged token signed with the known static secret to the '/sign/login/jwt/trust' endpoint, an attacker can impersonate any user, including administrators. Successful exploitation grants the attacker full administrative access to the SSO platform, enabling the modification of SSO configurations and the exfiltration of downstream application secrets. This vulnerability is highly critical due to the ease of exploitation and the significant impact on centralized authentication security.

Impact

The vulnerability poses a severe threat to organizations using MaxKey for SSO, as it allows for complete compromise of the identity provider. Successful exploitation results in full administrative access, potentially leading to unauthorized access to all downstream applications integrated via SSO, exfiltration of credentials or sensitive configuration tokens, and long-term persistent access to the organization's identity infrastructure.

Recommendation

• Immediately audit all MaxKey deployments to identify and rotate the JWT signing secret found in 'application-maxkey.properties'.
• Restrict network access to the '/sign/login/jwt/trust' endpoint to known, trusted management IP addresses.
• Monitor web server logs for suspicious POST requests to the '/sign/login/jwt/trust' path, specifically looking for anomalous successful authentication attempts originating from untrusted sources.
• Apply patches provided by the MaxKey project immediately upon availability.