AJ-Report versions through 1.7.1 use a hard-coded JWT secret to sign share tokens. This allows attackers to forge valid share tokens offline. By crafting a token with the reportCode 'dataSet', attackers can access the testTransform endpoint, which executes scripts via GroovyClassLoader without authentication, leading to remote code execution.