Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Rapid7 and Microsoft disclosed CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint's JWT token validation that allows unauthenticated remote attackers to forge valid tokens and impersonate any site user or administrator. The vulnerability stems from four chained weaknesses in the token validation pipeline: disabled signature verification on outer tokens, unverified actor token resolution using attacker-controlled certificate thumbprints, overly permissive issuer validation, and non-cryptographic signature checks. Rapid7 has published a technical analysis and proof-of-concept demonstrating how attackers can construct malicious JWTs to gain authenticated access to vulnerable SharePoint Server Subscription Edition instances.