External risk intelligence

MaxKey JWT Signing Secret Vulnerability Allows Unauthorized Access

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-69102

MaxKey is an identity management and Single Sign-On (SSO) solution. Such systems are designed to be internet-facing to facilitate centralized authentication for users and applications, making the login and trust endpoints inherently exposed to the public internet by design in normal deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in MaxKey allows unauthenticated attackers to bypass security controls by exploiting a hard-coded secret to forge authentication tokens. This could grant unauthorized access to sensitive application configurations and secrets within your Single Sign-On environment. The primary concern is confirming if this technology is deployed within your organization and, if so, understanding the potential exposure.

Attackers can impersonate any user without credentials.
Critical access could be gained to sensitive system configurations.
Verify if MaxKey is in use and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting a hard-coded secret within MaxKey's JWT signing mechanism. This allows them to craft a malicious token and use a specific login endpoint to impersonate any user, including administrators, granting them access to sensitive application configurations and secrets.

No authentication required for attack.
Triggered via password-skipped login endpoint.
Risk of unauthorized admin access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to forge valid JWT tokens and gain administrative access to MaxKey. This access could be used to view and modify SSO application configurations and potentially expose downstream application secrets.

MaxKey SSO configuration and secrets.
Forging JWTs with a known secret.
Compromised authentication and application secrets.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MaxKey, an SSO solution, allows unauthenticated attackers to forge JWT tokens and gain administrative access to application configurations and secrets. The first practical step is to identify all MaxKey instances, determine their exposure and criticality, and locate the accountable owner to plan remediation.

Application owners and platform teams likely responsible.
Verify MaxKey instance exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MaxKey?

MaxKey is an open-source Identity and Access Management (IAM) and Single Sign-On (SSO) solution. Organizations use it to centralize how users authenticate across various applications. Because it manages identities and coordinates access, it acts as a gatekeeper for connecting users to other internal and third-party software systems.

What is the weakness in CVE-2026-69102?

The vulnerability involves the use of a hard-coded cryptographic key, classified as CWE-798 (Use of Hard-coded Credentials). MaxKey uses a default, publicly known secret to sign JSON Web Tokens (JWTs). Because the secret is embedded directly in the application configuration, an attacker can use it to forge their own security tokens, essentially creating a fake "key" that the system accepts as valid authorization.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted, forged JWT token to a specific authentication endpoint designed to trust these tokens. This bypasses standard password requirements. Crucially, the attack does not require prior user credentials or existing access to the system. It is the misuse of the trusted token endpoint itself that facilitates the unauthorized entry.

Is my MaxKey instance at risk?

If you run MaxKey, your instance is at risk because Halo Surface Signal notes these systems are designed to be internet-facing to support SSO functions. Being accessible via the public internet means an attacker can reach the vulnerable trust endpoint without needing to be on your local network. You should assume that any internet-exposed instance is potentially reachable by an unauthorized party.

How should I respond to this vulnerability?

Your first step is to locate all deployed MaxKey instances within your infrastructure and identify the teams responsible for them. Once you have a complete inventory, verify the network exposure of each instance and coordinate with the owners to prioritize remediation. Do not assume any instance is safe simply because it sits behind a standard perimeter.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.