Critical
pac4j-jwt JwtAuthenticator Authentication Bypass
Type: advisorySources: OSV
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-29000
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 09:26 UTC · Revision 1
Source evidence
pac4j-jwt JwtAuthenticator Authentication Bypass
core-osv · Original sourcePublished 4 Mar 2026, 21:49 UTC
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
osv:CVE-2026-29000
Complete source record
{
"id": "080a4427bba39c9677258715013a85e60a7fca28f5433b79341346f17c60fd9d",
"url": "https://osv.dev/vulnerability/CVE-2026-29000",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "pac4j-jwt JwtAuthenticator Authentication Bypass",
"summary": "pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.",
"evidence": "osv:CVE-2026-29000",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-29000",
"aliases": [
"CVE-2026-29000",
"GHSA-pm7g-w2cf-q238"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pac4j/pac4j",
"type": "GIT",
"events": [
{
"introduced": "332a4f2d38015495108b225a3f7353a165969f90"
},
{
"fixed": "6ef35c29ee47726744dd4181b88456684f5efbf9"
},
{
"introduced": "c4aa7948f21985f9acc6778414afc9719c79befb"
},
{
"fixed": "244459565b06f0d9fa3f2526890ed79a36bfe169"
},
{
"introduced": "355a7201cb9a1e5ded694683464332418802cac8"
},
{
"fixed": "8dc2ff5c39ce5570cc429422517f6e3f321d5ad0"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "4.0"
},
{
"fixed": "4.5.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "5.0"
},
{
"fixed": "5.7.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "6.0"
},
{
"fixed": "6.3.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"pac4j-parent-6.3.2",
"pac4j-parent-6.3.1",
"pac4j-parent-6.3.0",
"pac4j-parent-6.2.2",
"pac4j-parent-5.7.8",
"pac4j-parent-6.2.1",
"pac4j-parent-6.2.0",
"pac4j-parent-6.1.3",
"pac4j-parent-6.1.2",
"pac4j-parent-6.1.1",
"pac4j-parent-6.1.0",
"pac4j-parent-6.0.6",
"pac4j-parent-5.7.7",
"pac4j-4.5.8",
"pac4j-parent-6.0.5",
"pac4j-parent-5.7.6",
"6.0.4.1",
"pac4j-parent-6.0.4",
"pac4j-parent-6.0.3",
"pac4j-parent-5.7.5",
"pac4j-parent-5.7.4",
"pac4j-parent-6.0.2",
"pac4j-parent-5.7.3",
"pac4j-parent-6.0.1",
"pac4j-parent-6.0.0",
"pac4j-parent-5.7.2",
"pac4j-parent-5.7.1",
"pac4j-parent-5.7.0",
"pac4j-parent-5.6.1",
"pac4j-4.5.7",
"pac4j-parent-5.6.0",
"pac4j-parent-5.5.0",
"pac4j-parent-5.4.6",
"pac4j-parent-5.4.5",
"pac4j-parent-5.4.4",
"pac4j-parent-5.4.3",
"pac4j-parent-5.4.2",
"pac4j-4.5.6",
"pac4j-parent-5.4.0",
"pac4j-4.5.5",
"pac4j-parent-5.3.1",
"pac4j-parent-5.3.0",
"pac4j-parent-5.2.1",
"pac4j-4.5.4",
"pac4j-parent-5.2.0",
"pac4j-4.5.3",
"pac4j-5.1.5",
"pac4j-5.1.4",
"pac4j-4.5.2",
"pac4j-5.1.3",
"pac4j-5.1.2",
"pac4j-5.1.1",
"pac4j-4.5.1",
"pac4j-5.1.0",
"pac4j-4.5.0",
"pac4j-5.0.1",
"pac4j-5.0.0",
"pac4j-4.4.0",
"pac4j-4.3.1",
"pac4j-4.2.0",
"pac4j-4.1.0",
"pac4j-4.0.3",
"pac4j-4.0.2",
"pac4j-4.0.1",
"pac4j-4.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29000.json"
}
}
],
"modified": "2026-10-28T02:30:50.565280686Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29000.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-29000",
"https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html",
"https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass",
"https://github.com/pac4j/pac4j",
"https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key"
],
"provider_metadata": {
"cwe_ids": [
"CWE-347"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29000.json"
}
},
"related_cves": [
{
"value": "CVE-2026-29000",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518873,
"published_at": "2026-03-04T21:49:29.34+00:00"
}