Skip to content
OpenAdvisories

Product · dromara

MaxKey

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-69102

    MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

    MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login …

    dromara MaxKey