Executive brief
MaxKey is an open-source identity and access management (IAM) platform used for single sign-on (SSO) and user authentication across multiple applications. A hard-coded JWT signing secret in its configuration file allows unauthenticated attackers to forge valid authentication tokens and gain admin access to the entire system, compromising all downstream application secrets and user data.
Technical details
MaxKey contains a hard-coded JWT signing secret in application-maxkey.properties that is publicly known. The vulnerability resides in the password-skipped login endpoint (/sign/login/jwt/trust), which accepts JWT tokens signed with this default secret without verifying their legitimacy. An unauthenticated attacker can craft a malicious JWT token using the publicly disclosed secret, submit it to the endpoint, and obtain a fully authenticated admin session. This grants complete access to SSO application configuration, user management, and all downstream application secrets. The vulnerability has been patched in a subsequent commit to the GitHub repository.
Affected products
- Dromara MaxKey <UNKNOWN>
Timeline
- 2026-08-11: disclosed