This vulnerability allows a non-admin refresh token to mint an admin-scoped access token in Artifactory — a classic scope-compatibility failure at the token minting endpoint. The refresh token passes cryptographic validation, but the system fails to verify that the token's implicit scope (non-admin) is compatible with the requested output scope (admin). This is not a flaw in the core token validation library; it's a missing guard at the specific endpoint that mints new access tokens from refresh tokens.
The severity is amplified by Artifactory's role in your supply chain. An admin token doesn't just grant UI access — it controls repository configuration, deployment pipeline settings, secret storage, and the ability to modify artifacts that downstream systems trust. If an attacker can escalate a developer or automation account's refresh token to admin, they effectively own your software supply chain.
Immediate actions: First, audit which user accounts in your Artifactory instance have refresh token capability. Non-admin users who can authenticate at all are potential escalation paths — this includes service accounts and CI/CD service users. Second, check your logs for any anomalous token minting operations, specifically refresh token exchanges that resulted in admin-scoped access tokens. The CVSS vector likely shows low complexity and requires authentication, but the EPSS score understates risk in environments where non-admin accounts are provisioned liberally.
The likely fix added a scope-compatibility guard at the token minting endpoint. However, other token minting paths in Artifactory — service token generation, artifact-scoped tokens, API key derivation — may lack equivalent guards if they weren't rewritten to share the new validation logic. Audit those paths explicitly. The pattern of refresh-token-to-privilege-escalation has appeared in other OAuth-adjacent systems; treat this as evidence that your token minting architecture needs a systematic scope-enforcement review, not just a point fix.