CVE-2026-29000

Critical · CVSS 9.1

pac4j-jwt — JWT authentication bypass via JWE-wrapped PlainJWT (improper signature verification, CWE-347)

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-347

Description

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Search profile — drives PoC discovery

Symbols JwtAuthenticatorPlainJWTJWEJWEObjectSignedJWTJWTClaimsSetpac4j-jwtorg.pac4j.jwtJwtGeneratorvalidateSignaturegetClaimsSetencryptedJWTRSAEncrypterRSADecrypterPlainHeaderAlgorithm.NONE

Keywords CVE-2026-29000pac4j-jwt authentication bypassJwtAuthenticator PlainJWT bypasspac4j JWE wrapped PlainJWTpac4j RSA public key forge JWTpac4j-jwt signature verification bypasspac4j authentication bypass exploitpac4j-jwt PoCpac4j JWE PlainJWT arbitrary claimspac4j-jwt 4.5.9 5.7.9 6.3.3

Versions: < 4.5.9, < 5.7.9, < 6.3.3

Ranked PoCs (22) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

kernelzeroday/CVE-2026-29000 candidate

containerized · recent activity

gh_search · Python

★ 8
ClayOfGilgamesh/CVE-2026-29000 candidate

containerized · recent activity

gh_search · Python

★ 0
rootdirective-sec/CVE-2026-29000-Lab candidate

containerized · recent activity

gh_search · Java

★ 0
lucastran05/CVE-2026-29000 candidate

containerized

gh_search · Java

★ 0
0xW1LD/CVE-2026-29000 needs review

recent activity

gh_search · Rust

★ 0
Gajraj238/CVE-2026-29000 needs review

recent activity

gh_search

★ 0
Strikoder-Premium/CVE-2026-29000-pac4j-jwt needs review

recent activity

gh_search · Python

★ 3
RootX111/cve-2026-29000 needs review

recent activity

gh_search · Python

★ 2
alihussainzada/CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc needs review

recent activity

gh_search · Python

★ 1
c0gnit00/CVE-2026-29000 needs review

recent activity

gh_search · Python

★ 1
manbahadurthapa1248/CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC needs review

recent activity

gh_search · Python

★ 1
otuva/CVE-2026-29000 needs review

recent activity

gh_search · Python

★ 1
Crims-on/CVE-2026-29000 needs review

recent activity

gh_search · Python

★ 0
FranzAlvis/Cve_2026_29000_exploit needs review

recent activity

gh_search · Python

★ 0
PtechAmanja/CVE-2026-29000-pac4j-jwt-auth-bypass needs review

recent activity

gh_search · Python

★ 0
cipher1x1/CVE-2026-29000 needs review

recent activity

gh_search · Python

★ 0
jake-young-dev/CVE-2026-29000 needs review

recent activity

gh_search · Python

★ 0
ledksv/Principal-HackTheBox needs review

recent activity

gh_search

★ 0
yasirr10/CVE-2026-29000 needs review

recent activity

gh_search · Python

★ 0
zF-tm/CVE-2026-29000 needs review

recent activity

gh_search · Python

★ 0
tc4dy/CVE-2026-29000-PoC-Exploit needs review

gh_search · Python

★ 3
dua2z3rr/CVE-2026-29000-PoC needs review

gh_search · Python

★ 1

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

Affected packages

Maven	org.pac4j:pac4j-jwt	0 → 4.5.9
Maven	org.pac4j:pac4j-jwt	5.0.0-RC1 → 5.7.9
Maven	org.pac4j:pac4j-jwt	6.0.4.1 → 6.3.3

References

Status: enriched · ingested 2026-07-15T00:00:20.000Z · profiled 2026-07-15T00:30:20.000Z