Vulnerability Disclosure and Exploitation

An empty string in Artifactory's default join keys mints a platform admin token

The bypass needs no credential, and exploitation followed JFrog's 28 August disclosure by three days. ZoomEye's fingerprint puts 17,874 Artifactory services on the internet, though only self-hosted instances on affected versions are in scope.