CVE-2026-29000 Details

An authentication bypass vulnerability has been identified in the pac4j-jwt library, specifically in versions prior to 4.5.9, 5.7.9, and 6.3.3. This vulnerability arises in the JwtAuthenticator component when handling encrypted JSON Web Tokens (JWTs). It allows remote attackers to forge authentication tokens by creating a JWE-wrapped PlainJWT with arbitrary subject and role claims. Attackers must possess the server's RSA public key to exploit this vulnerability, as it bypasses signature verification, enabling authentication as any user, including administrators.

Users of pac4j-jwt should upgrade to version 4.5.9 or newer for the 4.x line, version 5.7.9 or newer for the 5.x line, and version 6.3.3 or newer for the 6.x line.