Vulnerability · Published Mar 4, 2026 · Assigned by VulnCheck
CVE-2026-29000pac4j-jwt JwtAuthenticator Authentication Bypass
Critical 9.1
In plain English
A critical-severity security flaw in pac4j-jwt from pac4j. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.pac4j:pac4j-jwt | 6.3.3 | GHSA-pm7g-w2cf-q238 |
| Maven | org.pac4j:pac4j-jwt | 5.7.9 | GHSA-pm7g-w2cf-q238 |
| Maven | org.pac4j:pac4j-jwt | 4.5.9 | GHSA-pm7g-w2cf-q238 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html vendor-advisory
- https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key technical-description, exploit
- https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass third-party-advisory