Every CVE Search/ Get API key

CVE-2026-29000

pac4j-jwt JwtAuthenticator Authentication Bypass

9.3 CriticalPublic exploitFix available

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

6.17%Up 5.9 points since Mar 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.3

pac4j-jwt JwtAuthenticator Authentication Bypass

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Record
CVE-2026-29000
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
EUVDEUVD-2026-9505 9.3

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Record
EUVD-2026-9505
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-pm7g-w2cf-q238 10.0

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Record
GHSA-pm7g-w2cf-q238
CVSS 4.0
10.0 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-347
Updated
2026-11-02
NVD 9.3

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Record
CVE-2026-29000
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
OSV 9.3

pac4j-jwt JwtAuthenticator Authentication Bypass

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Record
CVE-2026-29000
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-347
Updated
2026-11-02
OSVGHSA-pm7g-w2cf-q238 10.0

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Record
GHSA-pm7g-w2cf-q238
CVSS 4.0
10.0 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-347
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.pac4j:pac4j-jwt
Maven
 6.0.4.1 up to 6.3.3
6.3.3
org.pac4j:pac4j-jwt
Maven
 5.0.0-RC1 up to 5.7.9
5.7.9
org.pac4j:pac4j-jwt
Maven
 before 4.5.9
4.5.9
org.pac4j:pac4j-jwt
Maven
 6.0.4.1 up to 6.3.3, plus listed versions
6.0.56.0.66.1.06.1.16.1.2
Show 7 moreShow less
6.1.36.2.06.2.16.2.26.3.06.3.16.3.2
6.3.3
org.pac4j:pac4j-jwt
Maven
 5.0.0-RC1 up to 5.7.9, plus listed versions
5.0.05.0.0-RC25.0.15.1.05.1.1
Show 27 moreShow less
5.1.25.1.35.1.45.1.55.2.05.2.15.3.05.3.15.4.05.4.15.4.25.4.35.4.45.4.55.4.65.5.05.6.05.6.15.7.05.7.15.7.25.7.35.7.45.7.55.7.65.7.75.7.8
5.7.9
org.pac4j:pac4j-jwt
Maven
 before 4.5.9, plus listed versions
1.8.01.8.0-RC11.8.11.8.21.8.3
Show 45 moreShow less
1.8.41.8.51.8.61.8.71.8.81.8.91.9.01.9.11.9.21.9.31.9.41.9.51.9.61.9.71.9.81.9.92.0.02.0.0-RC12.0.0-RC22.1.02.2.02.2.12.3.02.3.13.0.03.0.0-RC13.0.0-RC23.0.13.0.23.1.03.2.03.3.03.4.03.5.03.6.03.6.13.7.03.8.03.8.13.8.23.8.33.9.04.0.04.0.0-RC14.0.0-RC2
4.5.9

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub0xW1LD/CVE-2026-290002026-03-31
PoC in GitHubClayOfGilgamesh/CVE-2026-290002026-03-31
PoC in GitHubCrims-on/CVE-2026-290002026-03-13
PoC in GitHubErikgavs/CVE-2026-290002026-10-08
PoC in GitHubGajraj238/CVE-2026-290002026-04-10
PoC in GitHubPtechAmanja/CVE-2026-29000-pac4j-jwt-auth-bypass2026-03-24
PoC in GitHubRootX111/cve-2026-290002026-03-16
PoC in GitHubStrikoder-Premium/CVE-2026-29000-pac4j-jwt2026-05-03
PoC in GitHubalihussainzada/CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc2026-03-13
PoC in GitHubc0gnit00/CVE-2026-290002026-05-30
Show 13 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubcipher1x1/CVE-2026-290002026-04-17
PoC in GitHubdua2z3rr/CVE-2026-29000-PoC2026-07-11
PoC in GitHubjake-young-dev/CVE-2026-290002026-04-30
PoC in GitHubkernelzeroday/CVE-2026-290002026-03-05
PoC in GitHublucastran05/CVE-2026-290002026-06-01
PoC in GitHubmanbahadurthapa1248/CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC2026-03-13
PoC in GitHubotuva/CVE-2026-290002026-03-13
PoC in GitHubrootdirective-sec/CVE-2026-29000-Lab2026-03-11
PoC in GitHubtc4dy/CVE-2026-29000-PoC-Exploit2026-05-12
PoC in GitHubtscherwinski/CVE-2026-29000-jweforge2026-10-30
PoC in GitHubxiaoqiMikko/pac4j-check2026-08-04
PoC in GitHubyasirr10/CVE-2026-290002026-04-03
PoC in GitHubzF-tm/CVE-2026-290002026-05-05

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-29000 is a critical vulnerability (CVSS 9.3) in Pac4j Pac4j-jwt, published March 4, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.17%, the 93rd percentile. Fixed in org.pac4j:pac4j-jwt 6.3.3.

References

This page doesn't list everything

Left out here: 18 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open