Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
- ID
- 13780
- Status
- summarized
- Published
- 13 Aug 2026, 2:09 PM
- Fetched
- 13 Aug 2026, 4:21 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 13 Aug 2026, 4:22 PM
- Tags
- Audience
- developers
What happened
A critical SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) patched in Microsoft's July 2026 Patch Tuesday is now being actively exploited after Rapid7 released a Python proof-of-concept. The flaw chains four weaknesses in SharePoint's JWT token validation pipeline (SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2) to let an unauthenticated attacker forge a valid Bearer S2S token and impersonate any site user or administrator.
Why it matters
If your organization runs on-prem SharePoint and has not applied the July 2026 patch, patch immediately or restrict external access—public PoC code means exploitation is now trivial. For most SaaS founders and AI builders not running SharePoint, this is not actionable; the only transferable lesson is the JWT validation anti-pattern (accepting 'alg: none', not verifying x5t thumbprints against trusted issuers), worth checking in your own token-handling code.
Discussion angle
The four-step JWT forgery chain is a concrete checklist of token-validation mistakes—worth reviewing whether your own S2S or Bearer token code makes any of the same assumptions about algorithm headers, certificate thumbprint resolution, or trusted issuer lists.