CVE-2026-65616

Analyzed Analyzed - Analysis Complete

JFrog Artifactory Token Signature Authorization Bypass

Publication date: 2026-07-27

Last updated on: 2026-07-30

Assigner: JFrog

Description

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-30

Generated

2026-08-17

AI Q&A

2026-07-27

EPSS Evaluated

2026-08-15

NVD

CVE-2026-65616

EUVD

EUVD-2026-49576

Affected Vendors & Products

Vendor	Product	Version / Range
jfrog	artifactory	to 7.146.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect authorization validation in the refresh token signature mechanism. It allows non-admin users to obtain a signed JFrog administrator token, potentially granting elevated privileges.

Impact Analysis

An attacker could exploit this to gain administrator-level access to JFrog Artifactory, leading to unauthorized data access, modification, or deletion. This could compromise sensitive information and system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately revoke all active refresh tokens and invalidate existing sessions. Update JFrog Artifactory to the latest patched version to fix the authorization validation flaw.

Hi! I’m here to help you understand CVE-2026-65616. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70