CVE-2026-29000
CriticalCVSS 9.1Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
An authentication bypass vulnerability in pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 exists in JwtAuthenticator when processing encrypted JWTs. Attackers with the server's RSA public key can forge JWE-wrapped PlainJWTs with arbitrary claims, bypassing signature verification to impersonate any user including administrators.
Risk Assessment
The organization faces the risk of complete account takeover, including administrative accounts, potentially leading to unauthorized access to sensitive data and systems.
Recommendation
Immediately upgrade pac4j-jwt to version 4.5.9, 5.7.9, or 6.3.3 depending on your branch. If an upgrade is not possible, temporarily disable support for encrypted JWTs.
Original NVD description (English source)
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.