MaxKey - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/maxkey/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 11 Aug 2026 19:49:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMaxKey Unauthorized Access via Hard-coded JWT Signing Secrethttps://feed.craftedsignal.io/briefs/2026-08-maxkey-jwt-auth-bypass/Tue, 11 Aug 2026 19:49:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-maxkey-jwt-auth-bypass/MaxKey contains a critical vulnerability due to a hard-coded JWT signing secret that allows unauthenticated attackers to forge authentication tokens and gain administrative access.MaxKey contains an unauthorized access vulnerability (CVE-2026-69102) stemming from a hard-coded JWT signing secret within the 'application-maxkey.properties' file. This flaw permits unauthenticated attackers to forge valid JWT tokens, allowing them to bypass traditional authentication mechanisms. By submitting a forged token signed with the known static secret to the '/sign/login/jwt/trust' endpoint, an attacker can impersonate any user, including administrators. Successful exploitation grants the attacker full administrative access to the SSO platform, enabling the modification of SSO configurations and the exfiltration of downstream application secrets. This vulnerability is highly critical due to the ease of exploitation and the significant impact on centralized authentication security.

Impact

The vulnerability poses a severe threat to organizations using MaxKey for SSO, as it allows for complete compromise of the identity provider. Successful exploitation results in full administrative access, potentially leading to unauthorized access to all downstream applications integrated via SSO, exfiltration of credentials or sensitive configuration tokens, and long-term persistent access to the organization's identity infrastructure.

Recommendation

  • Immediately audit all MaxKey deployments to identify and rotate the JWT signing secret found in 'application-maxkey.properties'.
  • Restrict network access to the '/sign/login/jwt/trust' endpoint to known, trusted management IP addresses.
  • Monitor web server logs for suspicious POST requests to the '/sign/login/jwt/trust' path, specifically looking for anomalous successful authentication attempts originating from untrusted sources.
  • Apply patches provided by the MaxKey project immediately upon availability.
]]>criticaladvisory