The vulnerability originates from a hard‑coded JWT signing secret in the application-maxkey.properties file. Attackers can generate a JWT signed with this publicly known default key and send it to the /sign/login/jwt/trust endpoint, bypassing the password step entirely. By doing so, the attacker is authenticated as any intended user, including administrators, and gains full control over the SSO configuration and downstream secrets. This is a classic authentication bypass weakness (CWE‑798) that permits unauthorized access to privileged resources.

The flaw is present in MaxKey from dromara. The affected versions are not listed, so any deployed instance that has not been patched may be vulnerable. The vulnerability applies to installations that expose the /sign/login/jwt/trust endpoint.

The CVSS score of 9.3 indicates a high severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote and requires only HTTP access to the vulnerable endpoint. An attacker can forge a token, submit it, and immediately receive an authenticated admin session without further credentials.