Vendor
AJ-Report versions 1.7.1 and earlier contain a hard-coded JWT secret, enabling token forgery and unauthenticated remote code execution via the testTransform endpoint.