SharePoint CVE‑2026‑55040: JWT Bypass Exploited Worldwide – Patch Now

Threat Overview 🚨 Microsoft SharePoint now has a critical flaw, CVE-2026-55040, that has already started being exploited in the wild. ⚠️ The vulnerability scores a 9.1 on CVSS and lets unauthenticated attackers bypass authentication to perform arbitrary operations on any affected site. Vulnerability Technical Background 🔍 The root cause is a flaw in SharePoint’s JWT token validation chain used for service‑to‑service (S2S) communication. ❌ Two internal classes, SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2, incorrectly parse the outer header of a JWT, allowing attackers to skip signature verification under certain conditions. Exploit Chain Step‑by‑Step 1️⃣ The attacker crafts a JWT with alg=none in its outer header, effectively removing the requirement for an outer token signature. 2️⃣ An inner actor token is embedded that includes SharePoint’s own STS certificate thumbprint, tricking SharePoint into resolving a signing key without proper verification. 3️⃣ The resolved certificate is not listed in TrustedSecurityTokenServices, letting the issuer claim be accepted unquestioned. 4️⃣ The actor token’s signature can simply be a non‑empty placeholder like AAAA , which never gets validated, leaving the chain open for injection. Proof of Concept Availability 🔐 A fully functional Python PoC was released by Rapid7 earlier this week. # forge_jwt.py – minimal example import jwt , requests def craft_token (): header = { " alg " : " none " , " typ " : " JWT " } payload = { " iss " : " https://sharepoint.com " , " aud " : " https://sts.sharepoint.com " } return jwt . encode ( payload , key = None , algorithm = " none " , headers = header ) token = craft_token () print ( " Forged token: " , token ) ⚙️ The script demonstrates forging the JWT chain, querying a target domain controller, enumerating user SIDs, and automatically identifying site administrators. 📂 Full source code is available at hxxps://githubcom/sfewer-r7/CVE-2026-55040. Active Exploitation La