Pac4J-Jwt · Pac4J-Jwt · CVE-2026-29000
**Name of the Vulnerable Software and Affected Versions**
pac4j-jwt versions prior to 4.5.9
pac4j-jwt versions prior to 5.7.9
pac4j-jwt versions prior to 6.3.3
**Description**
An authentication bypass exists in the `JwtAuthenticator` component when processing encrypted JSON Web Tokens (JWTs). Remote attackers possessing the server's RSA public key can forge authentication tokens by creating a JWE-wrapped PlainJWT (an unsigned JWT) containing arbitrary subject and role claims. Because the library improperly handles these tokens, it skips the signature verification process, allowing the attacker to impersonate any user, including administrators.
**Recommendations**
Update pac4j-jwt to version 4.5.9 or later.
Update pac4j-jwt to version 5.7.9 or later.
Update pac4j-jwt to version 6.3.3 or later.