GitHub Advisoryadvisory · Maven

GHSA-pm7g-w2cf-q238 pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

CRITICAL Published 2026-03-05 Modified 2026-03-06 Official page ↗
Aliases
CVE-2026-29000
Ecosystem
Maven
Packages
org.pac4j:pac4j-jwt
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weaknesses
CWE-347
Reviewed
2026-03-06

Affected packages

• Maven org.pac4j:pac4j-jwt: >= 6.0.4.1, < 6.3.3 → fixed in 6.3.3 • Maven org.pac4j:pac4j-jwt: >= 5.0.0-RC1, < 5.7.9 → fixed in 5.7.9 • Maven org.pac4j:pac4j-jwt: < 4.5.9 → fixed in 4.5.9

Description

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Related

Alias · CVE (1)

  • CVE-2026-29000 pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References