CVE-2026-29000 pac4j-jwt JwtAuthenticator Authentication Bypass
Attackers with the server's RSA public key can forge JWTs to bypass authentication and gain administrator access in applications using pac4j-jwt.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29000?
CVE-2026-29000 is a critical authentication bypass vulnerability in pac4j-jwt, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
Weakness: CWE-347
Which versions are affected by CVE-2026-29000?
6 open source packages ship an affected version, including org.pac4j:pac4j-jwt.
| Package | Affected | Fixed in |
|---|---|---|
org.pac4j:pac4j-jwt Maven | All versions | 4.5.9 |
org.pac4j:pac4j-jwt Maven | All versions | 4.5.9 |
org.pac4j:pac4j-jwt Maven | From 5.0.0-RC1 | 5.7.9 |
org.pac4j:pac4j-jwt Maven | From 5.0.0-RC1 | 5.7.9 |
org.pac4j:pac4j-jwt Maven | From 6.0.4.1 | 6.3.3 |
org.pac4j:pac4j-jwt Maven | From 6.0.4.1 | 6.3.3 |
How do I fix CVE-2026-29000?
Upgrade org.pac4j:pac4j-jwt to a fixed version for your release line: 4.5.9, 5.7.9 or 6.3.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-29000 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29000 exists.
Public exploit code: 22 proofs of concept on GitHub.
Sources
Also known as GHSA-pm7g-w2cf-q238.