Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

Summary

Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

Timeline

1. Jan 21, 2026, 9:50 PM UTCCVE published
2. Jan 22, 2026, 3:13 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Jan 22, 2026, 4:49 PM UTCRecord last updated

Affected versions

• fleetdm fleet

  From 4.78.0 · fixed in 4.78.3; From 4.77.0 · fixed in 4.77.1; From 4.76.0 · fixed in 4.76.2; From 4.75.0 · fixed in 4.75.2; fixed in 4.53.3

• github.com/fleetdm/fleet/v4Go

  From 4.75.0 · fixed in 4.75.2; From 4.76.0 · fixed in 4.76.2; From 4.77.0 · fixed in 4.77.1; From 4.78.0 · fixed in 4.78.3

• github.com/fleetdm/fleetGo

  From 4.78.0 · fixed in 4.78.3

• github.com/fleetdm/fleetGo

  From 4.77.0 · fixed in 4.77.1

• github.com/fleetdm/fleetGo

  From 4.76.0 · fixed in 4.76.2

• github.com/fleetdm/fleetGo

  From 4.75.0 · fixed in 4.75.2

• github.com/fleetdm/fleetGo

  fixed in 4.43.5-0.20260112202845-e225ef57912c

References 2