CVE-2026-120209— AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

Quick assessment

Affected

anji-plus AJ-Report

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AJ-Report 1.7.1 及以下版本使用硬编码的 JWT 密钥对共享令牌进行签名，攻击者因此可离线伪造有效的共享令牌。攻击者可生成一个包含为的令牌，从而访问接口；该接口会将脚本传递给 GroovyClassLoader，导致未经身份验证的远程代码执行。

CVSS 9.8 · Critical EPSS 0.54% · P46 Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1059.006 · Python T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
anji-plus	AJ-Report	`≤ 1.7.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

Source: CVE Program / CVE List V5

Vulnerability Description

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的密码学密钥

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
anji-plus	AJ-Report	0 ~ 1.7.1	-

II. Public POCs for CVE-2026-120209

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120209

请登录查看更多情报信息。

Other References for CVE-2026-120209 (4)

https://gitee.com/belief-team/report product
https://gitee.com/belief-team/report/blob/V1.7.1/report-core/src/main/java/com/anjiplus/template/gaea/business/util/JwtUtil.java technical-description
https://gitee.com/belief-team/report/issues/IKRV6T issue-tracking
https://www.vulncheck.com/advisories/aj-report-through-1.7.1-authentication-bypass-leading-to-rce-via-share-token third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120209

IV. Related Vulnerabilities

Same product: AJ-Report

Same vendor: anji-plus

Same weakness: CWE-321