CVE-2026-29000: pac4j-jwt Authentication Bypass via JWE-Wrapped PlainJWT
Summary
CVE-2026-29000: pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT. Affects org.pac4j:pac4j-jwt across 3 version ranges.
< 4.5.9
>= 5.0.0-RC1, < 5.7.9
>= 6.0.4.1, < 6.3.3
Fixed in 4.5.9, 5.7.9 or 6.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pac4j-jwt library is a Java implementation that provides JWT (JSON Web Token) authentication for web applications. It allows developers to secure their applications by enabling token-based authentication, which is widely used for managing user sessions. The library supports various authentication mechanisms and is designed to be flexible and easy to integrate into existing Java applications. However, certain versions of pac4j-jwt are vulnerable to an authentication bypass issue, which can lead to unauthorized access to user accounts, including administrative privileges.
Vulnerability Detail
The vulnerability in pac4j-jwt arises from the JwtAuthenticator's handling of encrypted JWTs. Specifically, versions prior to 4.5.9, 5.7.9, and 6.3.3 allow attackers who possess the server's RSA public key to create a JWE-wrapped PlainJWT with arbitrary subject and role claims. This bypasses the signature verification process, enabling attackers to forge authentication tokens and authenticate as any user, including administrators. The critical nature of this vulnerability is underscored by its CVSS score of 10.0, indicating a severe risk to affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.94.5.9 -
>= 5.0.0-RC1, < 5.7.95.7.9 -
>= 6.0.4.1, < 6.3.36.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the server's RSA public key is not exposed to untrusted parties. Additionally, consider implementing additional layers of security, such as IP whitelisting or rate limiting, until the library can be updated.
Conclusion
The pac4j-jwt library has a critical vulnerability (CVE-2026-29000) that allows for authentication bypass through forged JWT tokens. It is crucial for users of affected versions to update to the patched versions to secure their applications against potential attacks.
See every vulnerability recorded for org.pac4j:pac4j-jwt →
FAQ
CVE-2026-29000 is a critical vulnerability in the pac4j-jwt library that allows attackers to bypass authentication by forging JWT tokens.
Versions prior to 4.5.9, 5.7.9, and 6.3.3 of pac4j-jwt are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 10.0, indicating a critical level of risk.
If you cannot update the library immediately, consider implementing additional security measures such as IP whitelisting or rate limiting to mitigate the risk.
