AJ‑Report versions up to 1.7.1 sign share tokens with a hard‑coded JWT secret. Attackers can generate a valid token offline by using this constant key. A forged token can set the reportCode parameter to 'dataSet' and call the testTransform endpoint. That endpoint directly passes scripts supplied in the request to GroovyClassLoader without authentication, enabling an attacker to execute arbitrary code on the host. The weakness is a credential management flaw (cryptographic key management). This allows full remote code execution and therefore complete compromise of the system.

Anji Plus AJ‑Report 1.7.1 is affected. There are no other vendors or product versions identified by the CNA; the vulnerability exists only in this version of the AJ‑Report application.

The CVSS base score of 9.3 classifies the issue as critical. Because the attack requires only the ability to forge a token and make an HTTP request, the vulnerability is accessible remotely and does not need local privileges. EPSS data is not available, so current exploitation likelihood is unknown; the vulnerability is not listed in CISA’s KEV catalog. The combination of a hard‑coded signing key, an unauthenticated entry point, and Groovy evaluation means that exploited systems could be fully compromised.