Rapid7 Analysis Microsoft SharePoint JWT Token Authenticatio...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040
• Blog Title: Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Microsoft SharePoint, with a cross-reference from Pentesting Web > JWT Vulnerabilities

🎯 Content Summary

Overview

CVE-2026-55040 is a critical, remotely exploitable, unauthenticated authentication bypass in the service-to-service (S2S) JWT validation pipeline of Microsoft SharePoint Server Subscription Edition. Rapid7 and Microsoft disclosed it on July 14, 2026; this technical analysis and PoC were published on August 11, 2026. The research was performed against a fully patched SharePoint Server Subscription Edition instance running 🔧 Technical Details

Nested JWT authentication bypass: When an application uses an outer JWT for user claims and an inner actor JWT for application identity, every layer must be cryptographically bound to the authenticated principal. If unsigned outer tokens are permitted, an attacker can place arbitrary identity, audience, issuer, and delegation claims in an alg: none token. An actor token that passes only structural or metadata checks can then make those untrusted outer claims appear authenticated.

Signing-key resolution is not signature verification: An attacker-controlled x5t can identify a legitimate public X.509 certificate and cause a resolver to populate a token's SigningToken. This proves only that a certificate with that thumbprint exists in a trust store; it does not prove possession of the private key. The implementation must verify the JWT signature bytes over base64url(header).base64url(payload) usi...

🤖 Agent Actions

ERROR: Codex exec failed (exit=1).
2026-08-11T19:04:31.499508Z ERROR codex_core::session: Failed to create session: required MCP servers failed to initialize: chack_tools: handshaking with MCP server failed: connection closed: initialize response
Error: thread/start: thread/start failed: error creating thread: Fatal error: Failed to initialize session: required MCP servers failed to initialize: chack_tools: handshaking with MCP server failed: connection closed: initialize response (code -32603)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 988
• MD files fixed: 5

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Microsoft SharePoint, with a cross-reference from Pentesting Web > JWT Vulnerabilities".

Repository Maintenance:

• MD Files Formatting: 988 files processed (5 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0