External risk intelligence

AJ-Report Hard-coded JWT Secret Enables Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120209

AJ-Report is a web-based reporting application designed for data visualization and report management. As a web application that manages and displays reports, it is commonly deployed as a network-accessible service to facilitate user access to reporting dashboards, making it likely to be reachable from the network or internet in typical deployments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in AJ-Report software that could allow unauthorized users to execute malicious code on affected systems. The issue stems from the way the software handles share tokens, using a hard-coded secret that attackers can exploit to create forged tokens. This could lead to significant security breaches if not addressed.

Forged tokens grant access for code execution.
Critical flaw impacts reporting software's security.
Confirm relevance and exposure of this software.

Attack Path

How an attacker could exploit the issue

Attackers can bypass authentication by forging a share token to access a vulnerable endpoint. This endpoint allows the submission of scripts that are then processed by a vulnerable component, enabling unauthenticated remote code execution.

Unauthenticated network access is required.
A crafted share token triggers script execution.
Remote code execution allows full system compromise.

Live Threat

Current exploitation, exposure, and threat context

AJ-Report's hard-coded JWT secret allows attackers to forge share tokens, enabling unauthenticated remote code execution through the testTransform endpoint when supported by the advisory.

System data could be compromised.
Forged tokens grant unauthenticated access.
Remote code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, the teams responsible for addressing this vulnerability depend on how AJ-Report is deployed. Application owners or platform teams managing the reporting service are typically the first point of contact. The immediate practical step is to identify all instances of AJ-Report, determine their reachability and criticality, and then assign ownership for remediation planning.

Accountable teams own this issue.
Verify report instances and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AJ-Report?

AJ-Report is a web-based application used for data visualization and report management. It helps users build and view dashboards, which typically requires it to be hosted as a network-accessible service so team members can interact with their reporting data.

How does the vulnerability in CVE-2026-120209 work?

This flaw is a case of CWE-321: Use of a Hard-coded Cryptographic Key. The software uses a fixed secret to sign authentication tokens. Because this secret is embedded in the code, an attacker can use it to create their own valid tokens, bypassing the application's login process to gain unauthorized access.

Does any specific action trigger the remote code execution?

Yes. An attacker must first forge a share token to gain access. Once they have that token, they specifically target the 'testTransform' endpoint with a crafted request. Simply having access to the server is not enough; the attacker must intentionally submit scripts to this specific endpoint to force the system to execute malicious code.

Why should I care about this if my instance is internal?

Halo Surface Signal indicates that AJ-Report is frequently deployed as a network-accessible service to support reporting dashboards. Even if you consider an instance internal, it may still be reachable by others on your network. If the service is accessible from the internet, the risk is significantly higher.

What is the first step to address this issue?

Begin by creating a comprehensive inventory of all AJ-Report installations in your environment. Once identified, evaluate which instances are reachable over your network. Finally, coordinate with the teams responsible for these specific systems to prioritize them for remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.