by Kastro
Paper/Archive/CVE-2026-29000

CVE-2026-29000

pac4j pac4j-jwt — pac4j-jwt JwtAuthenticator Authentication Bypass

EPSS 6%public exploitCVSS 9.3
critical.is priorityof 100
57
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 93.4.934 × 2018.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Affected

ProductAffectedFixed inSource
pac4j-jwt4.0 – < 4.5.94.5.9CNA
pac4j-jwt5.0 – < 5.7.95.7.9CNA
pac4j-jwt6.0 – < 6.3.36.3.3CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisorypac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.htmlexploitcodeant.ai/security-research/pac4j-jwt-authentication-bypass-public-keywriteupvulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass