JFrog Artifactory JFrog Access Authentication Bypass

This six-file Python repository contains two executable tools: exploit.py (44,485 bytes), an operational network exploitation toolkit, and safechecker.py (14,920 bytes), a separate non-intrusive defensive scanner. exploit.py defines a known 32-space HMAC secret and SHA-256 empty-string key identifier, forges an HS256 join JWT, and implements the documented JFrog Access join-to-administrator-token chain. Its advertised post-exploitation capabilities include configuration/token dumping, repository and user enumeration, administrator-user creation, token cleanup, interactive use, concurrent mass targeting, retries, proxy/proxy-list support, optional curl_cffi TLS impersonation, jitter, and header/User-Agent rotation. safechecker.py performs reachable/version/range checks, join-endpoint method checks, and anonymous-access assessment without acquiring tokens. requirements.txt lists requests, urllib3, and curl_cffi; README.md supplies workflow and remediation claims; remaining files are license and gitignore. The repository is standalone rather than a recognized exploit-framework module. The claimed CVE and affected-version assertions are represented as repository claims; the supplied material does not independently validate vendor advisories or exploit reliability.

This three-file repository contains a standalone Python exploit, a README, and an MIT license. The Python entry point implements the claimed CVE-2026-82329 chain against JFrog Artifactory/Access: it constructs an HS256 JWT using a fixed blank (space-filled) 32-byte HMAC secret, submits it to the registry-join API for a service token, and exchanges that token for an administrator-scoped bearer token. The script validates access through Artifactory and Access administration endpoints, then attempts to create a persistent hardcoded administrator user. The supplied README additionally describes intended collection of configuration, tokens, users, repositories, and secrets. The tool disables TLS certificate validation, forces NO_PROXY, accepts one URL or a target list, and concurrently processes up to 10 targets. It is an operational, destructive authentication-bypass/persistence tool rather than a detection-only PoC; however, the claimed CVE and affected-version claims are repository assertions and are not independently validated by the supplied content.

This three-file repository contains a standalone Go network exploit/assessment utility, a README, and a build/output-oriented .gitignore. The sole code file, CVE-2026-82329.go, accepts individual targets, a target-list file, or stdin; normalizes target URLs; and scans targets concurrently with configurable worker count and request timeout. It uses only the Go standard library. The code identifies itself with the Artifactory-like user agent `jfrt/0/7.161.19`, deliberately disables TLS certificate verification, and honors proxy environment settings. Its stated attack chain for self-hosted Artifactory is to forge a fresh HS256 join JWT using an assumed blank join-key-derived secret, submit it to the registry join endpoint for a service token, exchange that token for administrator permissions, and request the administrative system-configuration endpoint as validation. Command-line options support verbose logging of sensitive JWT/token material, displaying the minted administrator token, and a destructive persistent-admin creation action. There is no hard-coded victim host, callback server, or command shell payload; targets are supplied by the operator. The README documents intended authorized testing, patch-validation use, operational cautions, target input formats, and the reported fixed release versions. Although it includes vulnerability-detection behavior and result labels such as VULN/SAFE/FAIL, the token minting and optional account-persistence functions make it an active exploitation tool rather than a detection-only script.

This three-file repository contains a standalone Python 3 mass-exploitation tool, a README, and a simple Artifactory search dork. CVE-2026-82329.py is the sole executable entry point and uses only Python standard-library modules. It accepts individual or file-based target input, supports concurrent execution, forges a presumed-valid JFrog registry-join JWT using a hardcoded blank-secret assumption, posts it to the JFrog Access registry join API, and exchanges the resulting service token for an administrator access token. The tool includes token-only operation, administrative-access proof logic, optional administrator-user creation, console status/progress reporting, and persistent success/failure result files. It is an operational exploit rather than merely a detector because it attempts token minting and can establish persistent privileged access. The repository is not associated with a recognized exploit framework.

This is a two-file, standalone Python exploit/validator repository rather than a framework module. README.md documents the claimed CVE-2026-82329 Artifactory unauthenticated join-JWT flaw, affected versions, operational examples, and post-compromise API usage. artifactory.py is the executable entry point and uses only Python standard-library modules. It normalizes supplied URLs by removing common Artifactory UI prefixes, accepts individual URLs, a URL list, or stdin, and can scan targets concurrently with a ThreadPoolExecutor. Certificate and hostname verification are globally disabled to accommodate self-signed target certificates. The primary exploitation chain is implemented around a hardcoded blank join-key condition: the script derives the SHA-256 empty-string key ID, builds a current HS256 join JWT signed using 32 space bytes, and POSTs it to /access/api/v1/registry/join. If a service token is returned, it requests an administrative platform access token from /access/api/v1/tokens and checks privileged endpoints such as /artifactory/api/system/configuration. Results are categorized as VULN, SAFE, INFO, or FAIL. --token exposes the minted bearer credential, while --create-admin accepts user:password and attempts a potentially persistent local administrator creation action. The code is operational exploit code with a fixed exploit primitive and a direct administrative-token outcome, not merely a passive detector. No fixed victim host, IP address, or command-and-control infrastructure is embedded; targets are entirely operator supplied.

The repository consists of one standalone Python 3 proof-of-concept, artifactory-CVE-2026-82329-poc.py, and does not use an exploit framework. It implements an unauthenticated authentication bypass in vulnerable JFrog Artifactory/Access installations. The script constructs an HS256 join JWT using a deterministic signing key of 32 space bytes, which the source explains is produced when an empty default join key is incorrectly accepted and padded. It posts this token to the unauthenticated registry-join API to request a persistent service administrator token for an attacker-chosen service identity. After compromise, it performs authenticated post-exploitation through Access and Artifactory REST APIs: user discovery, token minting/impersonation, optional admin-password reset, and administrative-access verification. It also has a local --self-test mode that only builds and verifies the JWT without network activity, plus output/state-saving support. No hardcoded target domain, IP address, or external callback infrastructure is present; the base URL is supplied by the operator.

This is a standalone, dependency-free Python exploit/validator repository for the claimed CVE-2026-82329 JFrog Artifactory/JFrog Access authentication bypass; it is not a Metasploit, Nuclei, or other framework module. The main exploit is poc/cve_2026_82329_poc.py. It constructs an HS256 join JWT using the known 32-byte 0x20 secret associated with a blank join key and the SHA-256(empty) kid. It posts that JWT to the unauthenticated registry join API, receives an admin-scoped service token on vulnerable systems, then exchanges it through the Access token API for a non-expiring platform-admin token. It uses admin-only configuration and token-listing APIs as exploitation proof and can optionally create a persistent admin account on Pro/Enterprise deployments. The repository also includes a Docker/PostgreSQL A/B lab for Artifactory OSS 7.161.19 versus fixed 7.161.20, captured evidence, and Python patch-diff tooling/documentation explaining the blank-key trust flaw. The exploit targets the HTTP(S)-reachable JFrog Router, normally port 8082; it does not contain a reverse shell or arbitrary command-execution payload, but its token minting grants broad administrative control and access to sensitive configuration and tokens.