The vulnerability is a JWT signature bypass in Fleet's Windows MDM enrollment flow that allows attackers to submit forged authentication tokens without signature verification. By crafting such tokens, an attacker can cause Fleet to enroll unauthorized devices under arbitrary Azure AD user identities.

Affected products are Fleet, the open source device management software, in versions 4.53.3, 4.75.2, 4.76.2, 4.77.1, and earlier releases before 4.78.3 (any version containing the unverified JWT logic). Users of these releases are at risk if the Windows MDM feature is enabled.

The CVSS base score is 9.3, indicating a high severity. The EPSS score is reported as less than 1 % and the vulnerability is not listed in the CISA KEV catalog. Inference indicates that the attack vector is remote, relying on the ability to reach the Windows MDM enrollment endpoint. Exploitation would require an attacker to be able to query this endpoint and provide a forged token, after which Fleet would add the device to the fleet under the claimed Azure AD identity. The likelihood of exploitation at present appears low due to the very low EPSS score, yet the impact remains severe if it were successfully leveraged.