JFrog Artifactory Access Registry Join Authentication Bypass Exploit (CVE-2026-82329)

This module exploits an improper authentication vulnerability in the JFrog Access service used by JFrog Artifactory. In the vulnerable default configuration, Access trusts an additional cluster join key derived from an empty value. An unauthenticated remote attacker can use that known signing material to forge a valid HS256 cluster-join JWT and obtain a service identity without prior credentials. The forged service identity can then request an administrator-scoped access token. Successful authorization to an admin-only Artifactory endpoint demonstrates that the authentication boundary was bypassed. Important exploitation steps: Generate a fresh HS256 cluster-join JWT using the blank-key identifier and a generated service identifier. Submit the JWT to the unauthenticated Access registry-join endpoint and receive a service token. Exchange the service token for a non-refreshable administrator token with applied-permissions/admin scope, wildcard audience, and expires_in=0. Request the protected Artifactory system configuration endpoint with the administrator token. Confirm the vulnerability when the protected endpoint returns HTTP 200. Once this module validates the token, it is stored as a Core Impact HTTP identity so that it can be reused.