JFrog Artifactory EUVD-2026-57253

Exploitation requires SAML SSO to be configured and enabled in the Artifactory instance - deployments using only local or LDAP authentication are not affected. The attacker must have access to a valid SAML response, implying they either hold a legitimate user account in the federated identity provider or can intercept/capture an assertion in transit (e.g., via a man-in-the-middle position or session hijacking). The CVSS AC:H rating reflects that obtaining a valid SAML response is a non-trivial precondition. PR:L indicates the attacker must already have some authenticated foothold. Exploitation is limited by the requirement for SAML to be the active authentication method and by the need to possess or manipulate a legitimately issued assertion; unauthenticated external attackers with no IdP credentials cannot exploit this vulnerability.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.5. The High Attack Complexity (AC:H) materially constrains exploitability: the attacker must first obtain a valid SAML response, which requires operating within the SSO authentication flow or intercepting a legitimate assertion. The Low Privileges requirement (PR:L) further restricts exploitation to actors who already hold some form of valid access. Despite these constraints, the impact triad of C:H/I:H/A:H reflects worst-case impersonation of a highly privileged Artifactory user - potentially an admin - which could expose all artifacts, pipeline secrets, and access controls. No EPSS score was supplied, making probabilistic exploitation forecasting impossible. There is no CISA KEV listing and no confirmed public exploit, which lowers urgency compared to the raw CVSS score. The 'JWT Attack' tag implies this may be a known attack class (e.g., SAML assertion manipulation to forge JWTs), which increases the likelihood that skilled threat actors familiar with SAML attacks could reproduce exploitation. Risk is real but not immediate for organizations with network-segmented Artifactory deployments; organizations exposing Artifactory's SAML SSO endpoint to the internet or to broad internal networks face elevated exposure.

An attacker with a valid low-privileged Artifactory account participates in a SAML authentication flow and intercepts or retains their own issued SAML assertion. Using an XML Signature Wrapping technique or similar manipulation, the attacker modifies the assertion's NameID to reference a target user (such as an Artifactory admin) while preserving the valid cryptographic signature on an unrelated element. Artifactory's deficient signature verification accepts the assertion, issues a JWT token for the impersonated user, and grants the attacker full privileges of that account. No publicly available proof-of-concept code has been identified to confirm this specific exploitation path.