critical10.0
CVE-2026-29000
pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT
Impact
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.pac4j:pac4j-jwt | >= 6.0.4.1, < 6.3.3 | 6.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pac4j | Pac4j-Jwt | before 4.5.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key
- https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html
- https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass
- https://github.com/advisories/GHSA-pm7g-w2cf-q238
- https://nvd.nist.gov/vuln/detail/CVE-2026-29000