## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-DINOSN-CVE-2026-82329-JFROG-ARTIFACTORY
# CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass → admin takeover
**CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) · CWE-287 · disclosed 2026-08-28 · exploited in the wild.**
An unauthenticated, network-adjacent attacker mints a **platform administrator access token** against a default self-hosted JFrog Artifactory. This directory contains a reproducible Docker lab and a URL-parameterised validator PoC.
Reproduced and A/B-verified on `artifactory-oss` **7.161.19** (vulnerable, JFrog Access 7.191.11) vs **7.161.20** (patched, JFrog Access 7.191.14).
> Root cause was **derived from the vendor patch itself** (bytecode diff of the closed-source JFrog Access service between the two container images), then proven live — not taken from any third-party write-up.
* * *
## TL;DR exploit chain (all unauthenticated)
1. **Forge a cluster "join" JWT.** JFrog Access verifies join JWTs with the platform _join key_ used as an HMAC secret. A bug leaves a **blank join key** in the trusted verifier set on a default install. `getSigningKey("")` = `pkcs7(<empty>, 32)` = **32 bytes of** — a fully known secret. So anyone can sign a valid join JWT (, , fresh , any , ).