CVE-2026-82329 — JFrog Artifactory Unauthenticated Authentication Bypass (Mass Exploit)

Critical Authentication Bypass (CVSS 9.8) — Actively Exploited in the Wild

This tool is a mass exploit for CVE-2026-82329, a vulnerability that allows an unauthenticated attacker with network access to obtain full administrative privileges on self‑hosted JFrog Artifactory instances. It supports single‑target and batch scanning with multi‑threading.

⚠️ Vulnerability Overview

Root Cause

In default installations, JFrog Access keeps a blank join key in the trusted verifier set. This empty string becomes a fully known 32‑byte HMAC secret, allowing an attacker to forge a valid cluster "join" JWT.

Attack Chain

1. Forge a join JWT using the blank key (alg=HS256, kid=SHA256("")).
2. POST /access/api/v1/registry/join — no authentication required → returns a SERVICE token with admin scope.
3. POST /access/api/v1/tokens — uses the service token to mint a full administrative access token.
4. Use the admin token to:
   • Read system configuration
   • List / steal all existing access tokens
   • Create admin users and repositories
   • Poison artifacts (supply‑chain attack)

📦 Affected Versions

JFrog Cloud is NOT affected — only self‑managed instances.

🚀 Features

• ✅ Single‑target mode (-u)
• ✅ Batch scanning from file (-f targets.txt)
• ✅ Multi‑threading (-t 20)
• ✅ Automatic proof of admin — verifies token by accessing admin‑only endpoints
• ✅ Persistent admin user creation (--create-admin USER:PASS)
• ✅ Token‑only mode (--token-only) for scripting
• ✅ Progress bar with spinner and real‑time stats
• ✅ Output files:
  • artifactory_pwned.txt — vulnerable targets with admin tokens
  • artifactory_failed.txt — failed targets with error reasons

📥 Installation

# Clone the repository
git clone https://github.com/0xCyp1337/CVE-2026-82329.git
cd CVE-2026-82329
python3 CVE-2026-82329.py -h

# No external dependencies — uses Python standard library only
# Tested on Python 3.8+