{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29000", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-03T16:42:01.012Z", "datePublished": "2026-03-04T21:49:29.340Z", "dateUpdated": "2026-05-11T23:11:42.643Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-11T23:11:42.643Z"}, "title": "pac4j-jwt JwtAuthenticator Authentication Bypass", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "affected": [{"vendor": "pac4j", "product": "pac4j-jwt", "repo": "https://github.com/pac4j/pac4j", "versions": [{"status": "affected", "version": "4.0", "lessThan": "4.5.9", "versionType": "custom"}, {"status": "affected", "version": "5.0", "lessThan": "5.7.9", "versionType": "custom"}, {"status": "affected", "version": "6.0", "lessThan": "6.3.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.5.9", "versionStartIncluding": "4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.7.9", "versionStartIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.3.3", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators."}]}], "references": [{"url": "https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html", "tags": ["vendor-advisory"]}, {"url": "https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key", "tags": ["technical-description", "exploit"]}, {"url": "https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "credits": [{"lang": "en", "value": "CodeAnt AI Security", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-07T04:55:36.270180Z", "id": "CVE-2026-29000", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:00:54.781Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29000", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-07T04:55:36.270180Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T16:21:48.858Z"}}], "cna": {"title": "pac4j-jwt JwtAuthenticator Authentication Bypass", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "CodeAnt AI Security"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/pac4j/pac4j", "vendor": "pac4j", "product": "pac4j-jwt", "versions": [{"status": "affected", "version": "4.0", "lessThan": "4.5.9", "versionType": "custom"}, {"status": "affected", "version": "5.0", "lessThan": "5.7.9", "versionType": "custom"}, {"status": "affected", "version": "6.0", "lessThan": "6.3.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html", "tags": ["vendor-advisory"]}, {"url": "https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key", "tags": ["technical-description", "exploit"]}, {"url": "https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.", "supportingMedia": [{"type": "text/html", "value": "pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.5.9", "versionStartIncluding": "4.0"}, {"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.7.9", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3.3", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-11T23:11:42.643Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29000", "state": "PUBLISHED", "dateUpdated": "2026-05-11T23:11:42.643Z", "dateReserved": "2026-03-03T16:42:01.012Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-04T21:49:29.340Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators."}, {"lang": "es", "value": "Las versiones de pac4j-jwt anteriores a la 4.5.9, 5.7.9 y 6.3.3 contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en JwtAuthenticator al procesar JWT cifrados que permite a atacantes remotos falsificar tokens de autenticaci\u00f3n. Los atacantes que poseen la clave p\u00fablica RSA del servidor pueden crear un PlainJWT envuelto en JWE con reclamaciones de sujeto y rol arbitrarias, omitiendo la verificaci\u00f3n de firma para autenticarse como cualquier usuario, incluidos los administradores."}], "id": "CVE-2026-29000", "lastModified": "2026-04-16T16:18:36.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-03-04T22:16:18.783", "references": [{"source": "disclosure@vulncheck.com", "url": "https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key"}, {"source": "disclosure@vulncheck.com", "url": "https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0,4.5.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0,5.7.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0,6.3.3)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 85.0, "source": "matching"}]}, "original": {"product": "pac4j-jwt", "source": "cna", "vendor": "pac4j"}, "product": "pac4j", "vendor": "pac4j"}], "analysis": {"en": {"generated_at": "2026-04-16T13:06:10.027072+00:00", "value": {"mitigation_remediation": ["Upgrade pac4j-jwt to version 4.5.9 or later (or 5.7.9 or 6.3.3) to eliminate the authentication bypass.", "Ensure that the RSA public key used for JWT verification is not exposed publicly; restrict access to the key material and rotate keys if compromised.", "If an immediate upgrade is not feasible, implement a network-level filter or application firewall rule that blocks or rejects JWE-wrapped PlainJWT tokens without proper signature validation, and verify that your application enforces signature checks for all incoming tokens."], "summary": {"action": "Immediate Patch", "impact": "Remote Authentication Bypass via Forged JWTs"}, "threat_synthesis": {"affected_systems": "The affected product is pac4j pac4j-jwt. Systems running any version of pac4j-jwt earlier than 4.5.9, 5.7.9, or 6.3.3 are impacted. No other products or vendors are listed as affected.", "description_and_impact": "The vulnerability is located in pac4j-jwt\u2019s JwtAuthenticator component in versions prior to 4.5.9, 5.7.9, and 6.3.3. An attacker who has the server\u2019s RSA public key can create a JSON Web Encryption (JWE) wrapped PlainJWT containing arbitrary subject and role claims. Because the token bypasses the signature verification step, the attacker can authenticate as any user, including administrators, thereby gaining unauthorized access to protected resources.", "risk_and_exploitability": "The CVSS base score of 9.3 marks this flaw as critical. The EPSS score of < 1% indicates a very low but non-zero probability that exploit code for this vulnerability is circulating in the wild, and it is not currently listed in the CISA KEV catalog. Exploitation requires remote access to the application and possession of the RSA public key, which an attacker can obtain if it is improperly exposed. Given the high potential impact and the fact that the malicious token can be crafted and sent over any network connection, administrators should treat this as an urgent patching issue."}}}}, "created": "2026-03-05T09:05:41.576738+00:00", "updated": "2026-04-16T13:15:06.223057+00:00", "vendors": ["pac4j", "pac4j$PRODUCT$pac4j"]}