CVE-2026-29000
pac4j-jwt JwtAuthenticator Authentication Bypass
- State
- Published
- Severity
- 9.3 Critical
- Published
- Mar 4, 2026
- Updated
- Oct 8, 2026
- Reserved
- Mar 3, 2026
Description
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
pac4j-jwtpac4j |
|
References
- https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.htmlvendor-advisory
- https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-keytechnical-descriptionexploit
- https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.