MaxKey Hard-Coded JWT Secret Authentication Bypass

Technical Analysis

CVE-2026-69102 (CVSS 9.8) stems from a static, publicly-known JWT signing secret embedded in application-maxkey.properties, which MaxKey uses to validate tokens submitted to the /sign/login/jwt/trust endpoint. Because the secret is not unique per deployment, an attacker can craft an arbitrary JWT payload (e.g., claiming an admin username), sign it with the known default key, and obtain a fully authenticated session without credentials. This session provides access to SSO application configuration data and secrets for all downstream applications integrated with MaxKey, enabling lateral compromise across the federated identity ecosystem. Given that MaxKey often centralizes authentication for internal tools, dashboards, and APIs, organizations using it as an identity broker for AI agent orchestration platforms, RAG pipelines, or internal LLM tool endpoints are at direct risk of credential and API key exposure, allowing attackers to hijack agent sessions or exfiltrate connected service secrets used by autonomous agents.

Affected Systems

MaxKey Identity and Access Management platform, all versions using default/unmodified JWT signing secret in application-maxkey.properties; specifically the /sign/login/jwt/trust password-skipped login endpoint

Indicators of Compromise

• application-maxkey.properties (default/unmodified JWT secret)
• /sign/login/jwt/trust (exploited endpoint)
• Anomalous JWT tokens signed with known default MaxKey secret
• Unexpected admin-level session creation without preceding credential submission

Remediation Steps

1. 1

   Rotate JWT Signing Secret

   Immediately replace the default/hard-coded JWT signing secret in application-maxkey.properties with a unique, cryptographically random value per deployment, then invalidate all existing sessions.

2. 2

   Patch or Upgrade MaxKey

   Apply the vendor patch that removes the hard-coded secret dependency and enforces mandatory secret configuration during setup.

3. 3

   Disable or Restrict Password-Skipped Login Endpoint

   If not required, disable /sign/login/jwt/trust; otherwise restrict access via network controls and require additional verification.

4. 4

   Audit Authentication Logs

   Review logs for unauthorized admin sessions, unexpected JWT trust logins, or anomalous access to SSO configuration and downstream application secrets.

5. 5

   Rotate Downstream Secrets

   Rotate all API keys, credentials, and secrets stored or brokered through MaxKey for downstream/federated applications, including any used by AI agent or automation platforms.

6. 6

   Implement WAF/Network Segmentation

   Restrict exposure of MaxKey management and authentication endpoints to trusted networks only.