Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2026-29000 EUVD-2026-9505GHSA-pm7g-w2cf-q238

pac4j-jwt JwtAuthenticator Authentication Bypass

Published Mar 4, 2026 · Updated Oct 8, 2026 · Assigned by VulnCheck

Vendor: pac4j Product: pac4j-jwt Package: org.pac4j:pac4j-jwt Ecosystem: Maven

Description

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Affected products

VendorProductAffectedFixed
pac4j pac4j-jwt 4.0 – < 4.5.9, 5.0 – < 5.7.9, 6.0 – < 6.3.3 4.5.9

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 23 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.pac4j:pac4j-jwt >= 6.0.4.1, < 6.3.3 6.3.3 GHSA-pm7g-w2cf-q238
Maven org.pac4j:pac4j-jwt >= 5.0.0-RC1, < 5.7.9 5.7.9 GHSA-pm7g-w2cf-q238
Maven org.pac4j:pac4j-jwt < 4.5.9 4.5.9 GHSA-pm7g-w2cf-q238

Advisories 1

References