Author: rootxharsh
Published: May 20, 2026
Source: https://www.hacktron.ai/blog/cve-2026-0265-panos-globalprotect-cas-auth-bypass
Summary
Hacktron’s writeup describes CVE-2026-0265, a JWT algorithm-confusion vulnerability in the Cloud Authentication Service (CAS) used by Palo Alto Networks PAN-OS with GlobalProtect. Because the token-verification code selects the signature algorithm purely from the attacker-supplied alg field and never cross-checks it against the expected key type, an attacker can forge authentication tokens and obtain unauthorized VPN access into an enterprise network. Palo Alto published an advisory on May 14, 2026, and affected PAN-OS deployments with CAS enabled should update. Details below are from the source; where the source is silent (e.g. exact fixed version numbers), this summary says so rather than inventing specifics.
Technical Details
The flaw is a classic JWT algorithm-confusion (key-confusion) bug in the CAS-to-PAN-OS verification stage. The verifier dispatches on the JWT’s alg string with no cross-check against the key type, so it will accept an HS256 (HMAC) token where an RS256 (RSA) token is expected. In that configuration the RSA public signing certificate — which is not secret — is fed to the verifier as the HMAC secret. An attacker who possesses the public certificate can therefore compute a valid HMAC over a token they craft, producing a signature the server treats as authentic without any access to the IdP’s private key or valid credentials. To assemble a working forgery the researcher notes an attacker needs three pieces of information: the device serial number (leaked in an outbound JWT), the CSP ID (retrievable via Palo Alto’s license API), and the CAS signing certificate (obtainable by intercepting the mTLS channel). With these, a token can be minted for an arbitrary user.
Impact
Successful exploitation lets an attacker completely bypass the authentication system and establish a GlobalProtect VPN connection into the target’s private enterprise network. Per the writeup, knowing only a target user’s email address is sufficient to forge a valid authentication token once the prerequisite device/certificate values are gathered. The affected product is Palo Alto PAN-OS with CAS enabled (described as older versions); the source does not enumerate an exact affected-version range, so that detail is not stated here.
Mitigation
Palo Alto Networks published a security advisory for CVE-2026-0265 on May 14, 2026. The recommended action is to update affected PAN-OS versions that have CAS enabled to a fixed release as directed by the vendor advisory. The source does not list specific fixed build numbers or workarounds beyond updating; consult the linked Palo Alto advisory for the authoritative fixed-version and remediation guidance.