CVE-2023-29357SharePoint JWT alg:none, impersonate any user
What broke
SharePoint Server verified OAuth JWTs in ReadTokenCore(). If the header set alg to none, signature verification was skipped. An unauthenticated attacker minted a token as Administrator. CVSS 9.8. Patched June 2023. STAR Labs chained it with CVE-2023-24955 at Pwn2Own for RCE. CISA added 29357 to KEV in January 2024 after exploitation.
Why it matters
alg:none is a twenty-year-old JWT lesson showing up in a Microsoft product that many enterprises treat as an intranet IdP. The same class returned in SimpleHelp and WordPress OAuth SSO. If your JWT library lets the token pick the algorithm, you are on this list.
What to do
- Patch on-prem SharePoint. If it was reachable after June 2023, review farm-admin and app-principal grants.
- Reject
alg:nonein every verifier you own. See the validate a JWT recipe. - Do not expose SharePoint's OAuth endpoints to the internet.
After you patch
Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.
- Revoke every session and refresh token, not just the passwords. A session issued before the patch is still valid after it.
- Enumerate accounts created or modified during the exposure window, including local accounts on the appliance itself, service accounts, and API tokens.
- Remove authentication methods you did not add. An attacker with administrative access enrols a factor so the access survives your remediation.
- Rotate every credential the compromised system could reach: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See secrets rotation.
- Assume the device is a pivot, not a destination. Check what it could authenticate to and treat that as in scope.
Sources
- NVD: CVE-2023-29357
- STAR Labs, SharePoint pre-auth RCE chain, September 2023
- CISA KEV
Related identity CVEs
Related on Start with Identity
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026
- CVEJetBrains TeamCity 2023 authentication bypass to RCE
Unauthenticated request becomes administrator, then code execution, on TeamCity On-Premises before 2023.05.4. CVSS 9.8. CISA KEV. Used by Russian state actors.
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f