JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
Priority MEDIUM 43CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Fix Fixed Artifactory (JFrog): 7.59.18, 7.63.18, 7.68.19 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JFrog | Artifactory | 7.59 to before 7.59.18; 7.59 to before 7.63.18; 7.59 to before 7.68.19; 7.59 to before 7.71.8 | 7.59.18, 7.63.18, 7.68.19, 7.71.8 | Patch available | CNA |
- Artifactory VendorJFrog Affected 7.59 to before 7.59.18; 7.59 to before 7.63.18; 7.59 to before 7.68.19; 7.59 to before 7.71.8 Fixed in 7.59.18, 7.63.18, 7.68.19, 7.71.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:* | 7.59.0 to before 7.59.18; 7.63.5 to before 7.63.18; 7.68.7 to before 7.68.19; 7.71.2 to before 7.71.8 | Vulnerable | JFrog |
- cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:* Versions 7.59.0 to before 7.59.18; 7.63.5 to before 7.63.18; 7.68.7 to before 7.68.19; 7.71.2 to before 7.71.8 Vulnerable ·JFrog
Remediation
- Fix · CNA Artifactory (JFrog) Fixed in 7.59.18, 7.63.18, 7.68.19, 7.71.8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-42662
- 2026-10-03 Alias added: GHSA-vf92-j6mr-cjmj
References
More JFrog Artifactory vulnerabilities
- TI-2026-56777 Potential authentication bypass leading to administrative access in Artifactory KEVCVSS 3.1CRITICAL 9.8
- TI-2026-30404 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation KEVCVSS 3.1HIGH 8.8
- TI-2026-30406 Anonymous user token generation exposure in JFrog Artifactory KEVCVSS 3.1HIGH 7.5
- TI-2026-47149 Authenticated users may write data outside the intended Docker cache path KEVCVSS 3.1MEDIUM 5.3
- TI-2019-13025 JFrog Artifactory does not enforce default admin password change CVSS 3.1CRITICAL 9.8
- TI-2019-07126 An issue was discovered in JFrog Artifactory 6.7.3. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2023-42662 · CVE Program
- CVE-2023-42662 · NVD
- FIRST EPSS
- GHSA-vf92-j6mr-cjmj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences