A default phantom or blank Artifactory cluster join key can be used to forge a cluster JWT and obtain an administrator token.

On affected self-managed installations, the default phantom or blank join-key condition permits a forged cluster JWT, a service administrator token, and then a platform administrator token. That identity can reach users, credentials, federated topology, and stored artifacts.