CVE-2026-55040-Mass-Exploit

kitploit · 2026-08-27

Description

JWT token bypass in Microsoft SharePoint allows impersonation of any user including admins.

Affected Microsoft Sharepoint Server versions

Microsoft Sharepoint Server< 16.0.19725.20434, 2016, 2019

All known vulnerabilities by product

Sharepoint Server

CVSS 9.1 for CVE-2026-55040

9.1

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:NONE

CVE Information

Exploit Details

Modified:2026-08-27 16:21

Last Seen:2026-08-27 19:54

Reporter:KitPloit

Tags

Microsoft SharePointJWT bypasstoken forgeryuser impersonationmass exploitadmin access

Other exploits for CVE-2026-55040

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

Exploit for CVE-2026-55040

2026-08-27 maxprog-svgGITHUB

2026-08-26 KitPloitKITPLOIT

Exploit for CVE-2026-55040

2026-08-26 zenzueGITHUB

Exploit for Improper Input Validation in Microsoft

2026-08-26 hypnguyen1209GITHUB

2026-08-25 KitPloitKITPLOIT

Exploit for CVE-2026-55040

2026-08-06 sfewer-r7GITHUB

Exploit Code

MARKDOWN14 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-MAXPROG-SVG-CVE-2026-55040-MASS-EXPLOIT
# Microsoft SharePoint용 JWT 토큰 우회 익스플로잇 (CVE-2026-55040, CVSS 9.1)

세 가지 공격 벡터를 사용하여 인증 토큰을 위조합니다:

  * "none" 알고리즘 (서명 검증 우회)
  * 취약한 HS256 시크릿 (무차별 대입 사전 지원 포함)
  * RS256 키 대체



관리자를 포함한 모든 사용자로 가장할 수 있습니다. 단일 대상 익스플로잇, 자동화된 curl 기반 공격, 대량 대상용 대량 공격 모드를 포함합니다. Python 3 필요.

https://satoshidisk.com/pay/CSGDgs