CVE-2026-65616
Awaiting Analysis Awaiting Analysis - Queue

JFrog Artifactory Token Signature Authorization Bypass

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: JFrog

Description
Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-65616
EUVD
EUVD-2026-49576

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jfrog artifactory *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect authorization validation in the refresh token signature mechanism. It allows non-admin users to obtain a signed JFrog administrator token, potentially granting elevated privileges.

Impact Analysis

An attacker could exploit this to gain administrator-level access to JFrog Artifactory, leading to unauthorized data access, modification, or deletion. This could compromise sensitive information and system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately revoke all active refresh tokens and invalidate existing sessions. Update JFrog Artifactory to the latest patched version to fix the authorization validation flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart