Description

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T18:17:29.473Z",
  "pubdate": "2026-08-12T18:17:29.473Z",
  "executiveSummary": "An improper authorization and access control vulnerability exists within JFrog Artifactory, wherein the application incorrectly generates and returns an internal anonymous-user token to an unauthenticated remote caller.\nThis behavior manifests specifically under misconfigured or default states where anonymous access is explicitly disabled within the system administration settings.\nThe primary impact of this flaw is the unauthorized disclosure of security credentials, namely an operational session or identity token associated with the internal anonymous user context.\nThe affected product is JFrog Artifactory. The risk implications are significant, as unauthorized entities can acquire functional authentication material despite administrative controls intended to restrict public visibility and access.\nAn unauthenticated attacker operating across network boundaries possesses the requisite capabilities to exploit this vulnerability without needing prior credentials or special privileges.\nSuccessful exploitation requires the ability to interact with the Artifactory endpoint handling authentication or session issuance, subsequently harvesting the leaked token to evaluate access boundaries against sensitive repositories, artifacts, and internal system resources.",
  "technicalDetails": "The root cause of this vulnerability lies in an authorization logic flaw within the token generation and session management subsystem of JFrog Artifactory.\nWhen anonymous access is toggled off in the administrative configuration, the expected security posture mandates the complete rejection of unauthenticated requests or the withholding of any identity tokens associated with unprivileged or guest personas.\nHowever, due to improper state validation within the request handling pipeline, the application still processes certain inbound unauthenticated requests by instantiating and serializing an internal anonymous-user token.\nThe vulnerable component involves the authentication handlers and API endpoints responsible for issuing session identifiers or authorization tokens.\nThe network exposure is remote, as attackers can interact directly with the exposed HTTP/HTTPS interfaces hosting the Artifactory service.\nNo authentication or privilege requirements are necessary on the part of the client, as the vulnerability is triggerable by unauthenticated external callers.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a targeted HTTP request directed at the vulnerable JFrog Artifactory instance, specifically targeting endpoints involved in session or token retrieval. Second, the server evaluates the request context but fails to properly enforce the disabled status of anonymous access during the token issuance routine. Third, the internal logic proceeds to generate an anonymous-user token and includes it in the HTTP response payload returned to the caller. Finally, the attacker captures the returned token and utilizes it in subsequent API interactions.\nThe payload behavior involves receiving a JSON or header-based token string representing the internal anonymous identity. Post-exploitation impact includes the potential bypassing of initial access restrictions, allowing the adversary to query sensitive resources, enumerate internal repository structures, or access artifacts that should theoretically require explicit authentication or authorization, depending on how permissions are mapped to the anonymous role within the specific Artifactory deployment."
}