A detailed technical analysis of CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint Server Subscription Edition (version 16.0.19725.20210). The vulnerability chains four distinct weaknesses in the JWT token validation pipeline: (1) RequireSignedTokens is explicitly set to false, disabling cryptographic signature verification on the outer token; (2) the actor token's x5t header is used to resolve a signing key without verifying the signature; (3) issuer validation accepts certificates not found in TrustedSecurityTokenServices, including SharePoint's own STS certificate; (4) GetTokenSignature only checks for a non-empty string, never verifying the signature cryptographically. An unauthenticated remote attacker can forge a JWT with alg:none, reference SharePoint's publicly accessible STS certificate thumbprint, and impersonate any user including site administrators. A proof-of-concept script is published alongside the analysis, demonstrating full authentication bypass via SID, UPN, or local service identity.
Questions this post answers
How does CVE-2026-55040 allow unauthenticated authentication bypass in Microsoft SharePoint?
CVE-2026-55040 chains four weaknesses in SharePoint Server's JWT validation pipeline. First, RequireSignedTokens is set to false, so the outer token needs no cryptographic signature (alg:none is accepted). Second, the actor token's x5t header resolves a signing key without verifying the signature. Third, issuer validation silently accepts certificates absent from TrustedSecurityTokenServices — including SharePoint's own STS cert. Fourth, GetTokenSignature only checks for a non-empty string like 'AAAA', never verifying it cryptographically. Security engineers hardening SharePoint deployments track JWT validation vulnerabilities like this on daily.dev.
How can I retrieve the SharePoint STS signing certificate without authentication to exploit CVE-2026-55040?
SharePoint exposes its STS signing certificate via an unauthenticated GET request to /_layouts/15/metadata/json/1. The response JSON includes the full base64-encoded x509 certificate under keys[].keyValue.value. From this certificate, the x5t value is computed by base64-decoding the certificate, computing its SHA1 digest, then base64-encoding the raw digest. The target realm is also returned in the issuer field of the same response. Researchers tracking unauthenticated information disclosure in enterprise platforms follow findings like this on daily.dev.
What identity mechanisms can be used to impersonate a user when forging a SharePoint JWT in CVE-2026-55040?
Three identity mechanisms work: a Windows Security Identifier (SID) in the nameid claim with urn:office:idp:activedirectory as the identity provider, a User Principal Name (UPN) such as administrator@domain.local, or the local service identity 0#.w|nt authority\local service via an AccessToken identifier. SID-based impersonation is more reliable for automation since domain SIDs can be enumerated via SMB NULL sessions against the domain controller's LSARPC named pipe. Penetration testers working SharePoint engagements keep up with exploitation techniques like these on daily.dev.