A critical hard-coded credential vulnerability in dromara MaxKey allows unauthenticated attackers to bypass authentication and gain full administrative control over the system.

This vulnerability (CWE-798) stems from the use of a hard-coded JWT signing secret within the application configuration. Unauthenticated attackers can leverage this known secret to forge JWT tokens, bypassing authentication mechanisms entirely to access sensitive SSO configurations and downstream secrets.

With a CVSS score of 9.8, this vulnerability poses a catastrophic risk to identity and access management security. A successful exploit grants an attacker full administrative access, potentially leading to widespread unauthorized access across all integrated SSO applications and the theft of downstream credentials.

Immediate Action: Update to the latest version of MaxKey and ensure the JWT signing secret is rotated to a unique, cryptographically secure value.

Proactive Monitoring: Monitor access logs for unauthorized authentication events or suspicious usage of the /sign/login/jwt/trust endpoint.

Compensating Controls: Place the MaxKey instance behind a robust Web Application Firewall (WAF) to block unauthorized requests to administrative endpoints while the remediation is being applied.

Public Exploit Available: Unknown

This is a critical security failure that requires immediate attention. Organizations must rotate the signing secret immediately upon patching, as the default secret is now considered public knowledge. Failure to remediate could result in the total compromise of all identity services managed by the MaxKey instance.