SharePoint JWT forgery: when token validation fails open

CVE-2026-55040 is a JWT token validation vulnerability in Microsoft SharePoint Server. The flaw allows an unauthenticated attacker to forge a token that SharePoint accepts as valid, granting access to SharePoint sites, list data, document libraries, and the SharePoint REST/SOAP APIs without supplying real credentials.

Rapid7's AttackerKB analysis is the primary technical reference. The MSRC advisory and NVD entry carry the authoritative version matrix.

The JWT validation flaw

SharePoint's token validation pipeline checks the JWT signature, but CVE-2026-55040 introduces a path where the validation function returns a success code in an error branch — a classic "fails open" condition. The practical consequence:

• A token with a structurally valid header and payload but an invalid or entirely absent signature passes validation
• SharePoint reads the identity claims from the forged payload and constructs an authenticated session
• No knowledge of the signing key is required

This is distinct from key confusion attacks (e.g., RS256→HS256 confusion) and from token theft. The validator does not verify the signature under the forged condition — it simply does not reject the token.

Validation flow: normal vs. forged

Scope of access with a forged token

The claims in the JWT payload determine what SharePoint exposes. An attacker can write arbitrary claims into the forged token — including user identity, group membership, and role assignments. Practically:

For on-premises SharePoint in an Active Directory environment, SharePoint service accounts often hold elevated AD privileges. Central Administration access may expose credentials or managed account passwords stored in the farm configuration database.

Affected versions

Verify the exact build matrix from MSRC. The vulnerability affects SharePoint Server 2019 and SharePoint Server Subscription Edition prior to the October 2026 CU. SharePoint Online (Microsoft 365) is a separate service and was updated server-side before disclosure.

Operator checklist

Identifying the SharePoint version:

# On a SharePoint server or via UNC to the hive path
Get-SPFarm | Select-Object BuildVersion

# Or via registry on the SharePoint server
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0" |
    Select-Object VersionBuildNumber

# HTTP response header on any /_vti_bin endpoint often leaks MicrosoftSharePointTeamServices header
# curl -I https://sharepoint.target.local/_vti_bin/sitedata.asmx

Testing the forgery (with engagement authorisation):

A forged token requires: 1. A valid JWT structure (header.payload.signature with base64url encoding) 2. A payload with an aud claim matching the target SharePoint instance's app ID 3. A sub or upn claim for the identity to impersonate 4. An invalid or empty signature value

Send the crafted Bearer token to any authenticated SharePoint REST endpoint:

GET /_api/web/currentuser HTTP/1.1
Host: sharepoint.target.local
Authorization: Bearer <forged_token>
Accept: application/json;odata=verbose

A valid JSON response with user details confirms the bypass. Capture the full HTTP request/response pair as evidence. Do not enumerate beyond what is needed to confirm the finding.

Evidence to capture: - SharePoint build version (from farm properties or registry) - Full HTTP request with forged token - HTTP 200 response with user context from /_api/web/currentuser - List of site collections accessible via the forged identity (from /_api/site/url)

Reporting this finding

CVE-2026-55040 has the characteristics that make token forgery especially reportable:

• No credentials required: authentication is entirely bypassed
• Identity is attacker-controlled: any user or admin identity can be impersonated
• API access, not just UI: SharePoint REST and SOAP APIs respond to valid tokens — data extraction, file enumeration, and permission changes are all possible via API
• Chains with lateral movement: SharePoint service account access often translates to AD enumeration or credential access

Report as an authentication bypass with the demonstrated impact (data access, admin panel access, or both). Pair with the October 2026 CU version delta and the specific build UBR confirming the environment is unpatched.