/Vulnerability Library

Microsoft SharePoint Server - JWT Authentication Bypass

CVE-2026-55040
Verified

Description

Microsoft SharePoint Server is vulnerable to an authentication bypass (CVE-2026-55040) in its JWT token validation pipeline (SPJsonWebSecurityTokenHandlerV2). The chain disables signature requirements (RequireSignedTokens=false, accepting alg:none tokens), resolves the actor token x5t thumbprint against the server's own STS signing certificate (freely retrievable from /_layouts/15/metadata/json/1) without verifying the signature, accepts unregistered certificate issuers, and only checks the actor token signature is non-empty. An unauthenticated remote attacker can forge a JWT and authenticate as any SharePoint user, including a site administrator. This template forges such a token and confirms the bypass by obtaining a SharePoint form digest.

Severity

Critical

CVSS Score

9.1

Exploit Probability

70%

Published Date

August 26, 2026

Template Author

sfewer-r7, dhiyaneshdk

CVE-2026-55040.yaml
9.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID:
cve-2026-55040
CWE ID:
cwe-1390

References

https://github.com/sfewer-r7/CVE-2026-55040https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/https://nvd.nist.gov/vuln/detail/CVE-2026-55040https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040

Remediation Steps

Update to the latest version of Microsoft Office SharePoint.