CVE-2026-55040 PoC — Microsoft SharePoint Server Security Feature Bypass Vulnerability

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-55040.yaml

Associated Vulnerability

Title: Microsoft SharePoint Server Security Feature Bypass Vulnerability (CVE-2026-55040)
Description:Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

Description

Microsoft SharePoint Server is vulnerable to an authentication bypass (CVE-2026-55040) in its JWT token validation pipeline (SPJsonWebSecurityTokenHandlerV2). The chain disables signature requirements (RequireSignedTokens=false, accepting alg:none tokens), resolves the actor token x5t thumbprint against the server's own STS signing certificate (freely retrievable from /_layouts/15/metadata/json/1) without verifying the signature, accepts unregistered certificate issuers, and only checks the actor token signature is non-empty. An unauthenticated remote attacker can forge a JWT and authenticate as any SharePoint user, including a site administrator. This template forges such a token and confirms the bypass by obtaining a SharePoint form digest.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →