CVE-2026-69102 describes a critical security vulnerability in dromara MaxKey caused by a hard-coded JWT signing secret located in application-maxkey.properties. Attackers can exploit this by crafting JWT tokens signed with the publicly known default secret and submitting them to the /sign/login/jwt/trust endpoint. This bypasses authentication controls, enabling attackers to impersonate any user and gain full administrative privileges, exposing sensitive SSO configurations and secrets. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability allows unauthenticated remote attackers to gain full administrative access to MaxKey instances by forging JWT tokens. This compromises the confidentiality and integrity of SSO configurations and downstream application secrets, potentially leading to complete system compromise and unauthorized access to connected applications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable JWT login endpoint or changing the default JWT signing secret if possible. Monitor vendor channels for updates and apply official patches once released.