CVE-2026-55040 SharePoint JWT alg=none Auth Bypass Attempt

Ankit Mehta@Secvyn

•updated Sep 28, 2026•0•0•7

Detects exploitation attempts against CVE-2026-55040 on Microsoft SharePoint Server. This vulnerability allows an attacker to bypass authentication by sending a malformed JSON Web Token (JWT) with an 'alg: none' header or an empty signature. The SharePoint server incorrectly trusts the provided token, enabling unauthorized access to sensitive API and SOAP endpoints.