anji-plus CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL anji-plus CVE published 2026-10-31

CVE-2026-120209

CVE-2026-120209 is a critical vulnerability in AJ-Report through version 1.7.1. The system signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. This enables access to the testTransform endpoint, leading to unauthenticated remote code execution via GroovyClassLoader. Defenders must verify AJ-Report version 1.7.1 usage and update or patch instances to prev [truncated]