CVE-2023-29357SharePoint JWT alg:none, impersonate any user
What broke
SharePoint Server verified OAuth JWTs in ReadTokenCore(). If the header set alg to none, signature verification was skipped. An unauthenticated attacker minted a token as Administrator. CVSS 9.8. Patched June 2023. STAR Labs chained it with CVE-2023-24955 at Pwn2Own for RCE. CISA added 29357 to KEV in January 2024 after exploitation.
Why it matters
alg:none is a twenty-year-old JWT lesson showing up in a Microsoft product that many enterprises treat as an intranet IdP. The same class returned in SimpleHelp and WordPress OAuth SSO. If your JWT library lets the token pick the algorithm, you are on this list.
What to do
- Patch on-prem SharePoint. If it was reachable after June 2023, review farm-admin and app-principal grants.
- Reject
alg:nonein every verifier you own. See the validate a JWT recipe. - Do not expose SharePoint's OAuth endpoints to the internet.
After you patch
Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.
- Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
- Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
- Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
- Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
- Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.
Sources
- NVD: CVE-2023-29357
- STAR Labs, SharePoint pre-auth RCE chain, September 2023
- CISA KEV
Related identity CVEs
Related on Start with Identity
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026
- CVEWSO2 API Manager accepts JWTs signed with unconfigured algorithms
WSO2 API Manager and related gateways validated JWTs signed with algorithms they were never configured to accept, allowing account takeover including admins. CV
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576