Microsoft SharePoint JWT Authentication Bypass Enables User or Admin Impersonation

Microsoft and Rapid7 disclosed CVE-2026-55040, an authentication bypass flaw in Microsoft SharePoint that allows a remote, unauthenticated attacker to impersonate a SharePoint site user or administrator. Rapid7 said the issue originates in SharePoint’s JWT token validation pipeline, aligning with the broader CWE-1390 Weak Authentication class in which identity checks fail to adequately verify a claimed user and can lead to unauthorized access and privilege abuse.

Microsoft has issued SharePoint updates addressing CVE-2026-55040, while Rapid7 reported the bug can be chained with a separate SharePoint remote code execution vulnerability to achieve unauthenticated RCE. Microsoft scored the authentication bypass at CVSS 5.3 and said the RCE component is planned for a later update cycle; Rapid7 noted that fixing the JWT flaw breaks the exploit chain that was developed during zero-day research for Pwn2Own Berlin.