Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.
Fix
Public exploits 2
- alixiacf/hpim-training-lab PoC on GitHub
- alixiacf/rep-openai-artifactory PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · jfrogNVD modified 2026-10-24 13:10
Affected (CPE criteria) 1
cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*