Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Strategic summary

On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint Server Subscription Edition. A remote unauthenticated attacker can bypass JWT token validation and impersonate any SharePoint site user or administrator. The root cause is a chain of four weaknesses in the JWT validation pipeline that together allow forging a valid token. Rapid7 has published a technical analysis and proof-of-concept.

Key findings

• Critical authentication bypass in SharePoint Server Subscription Edition: A remote unauthenticated attacker can impersonate any SharePoint site user or administrator.
• The vulnerability stems from a chain of four weaknesses in the JWT token validation pipeline: RequireSignedTokens disabled, actor token x5t resolution without signature verification, issuer validation accepts unregistered certificates, GetTokenSignature non-cryptographic check.
• Attackers can forge valid JWTs and perform operations with the privileges of a SharePoint site user or administrator.
• Affected is SharePoint Server Subscription Edition, version 16.0.19725.20210 and earlier. Rapid7 has released a technical analysis and proof-of-concept script.