pac4j-jwt JwtAuthenticator Authentication Bypass
Priority HIGH 81CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.06173 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed pac4j-jwt (pac4j): 4.5.9, 5.7.9, 6.3.3org.pac4j:pac4j-jwt (Maven): 6.3.3, 5.7.9, 4.5.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pac4j | pac4j-jwt | 4.0 to before 4.5.9; 5.0 to before 5.7.9; 6.0 to before 6.3.3 | 4.5.9, 5.7.9, 6.3.3 | Patch available | CNA |
| — | org.pac4j:pac4j-jwt (Maven) | 6.0.4.1 to before 6.3.3 | 6.3.3 | Patch available | GHSA-pm7g-w2cf-q238 |
| — | org.pac4j:pac4j-jwt (Maven) | 5.0.0-RC1 to before 5.7.9 | 5.7.9 | Patch available | GHSA-pm7g-w2cf-q238 |
| — | org.pac4j:pac4j-jwt (Maven) | before 4.5.9 | 4.5.9 | Patch available | GHSA-pm7g-w2cf-q238 |
- pac4j-jwt Vendorpac4j Affected 4.0 to before 4.5.9; 5.0 to before 5.7.9; 6.0 to before 6.3.3 Fixed in 4.5.9, 5.7.9, 6.3.3 Patch available CNA
- org.pac4j:pac4j-jwt (Maven) Vendor— Affected 6.0.4.1 to before 6.3.3 Fixed in 6.3.3 Patch available GHSA-pm7g-w2cf-q238
- org.pac4j:pac4j-jwt (Maven) Vendor— Affected 5.0.0-RC1 to before 5.7.9 Fixed in 5.7.9 Patch available GHSA-pm7g-w2cf-q238
- org.pac4j:pac4j-jwt (Maven) Vendor— Affected before 4.5.9 Fixed in 4.5.9 Patch available GHSA-pm7g-w2cf-q238
Remediation
- Fix · CNA pac4j-jwt (pac4j) Fixed in 4.5.9, 5.7.9, 6.3.3
- Fix · GHSA-pm7g-w2cf-q238 org.pac4j:pac4j-jwt (Maven) Fixed in 6.3.3 Advisory →
- Fix · GHSA-pm7g-w2cf-q238 org.pac4j:pac4j-jwt (Maven) Fixed in 5.7.9 Advisory →
- Fix · GHSA-pm7g-w2cf-q238 org.pac4j:pac4j-jwt (Maven) Fixed in 4.5.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-29000
- 2026-10-03 Alias added: GHSA-pm7g-w2cf-q238
- 2026-10-25 EPSS moved to the 90th–95th percentile
References
More pac4j vulnerabilities
- TI-2023-10883 Deserialization of untrusted data in InternalAttributeHandler in pac4j CVSS 4.0CRITICAL 9.2
- TI-2026-29211 LDAP Injection in PAC4J CVSS 4.0HIGH 8.7
- TI-2026-56857 pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check CVSS 4.0HIGH 8.6
- TI-2026-56855 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token CVSS 4.0HIGH 8.6
- TI-2026-56856 pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution CVSS 4.0MEDIUM 6.9
- TI-2021-20310 If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no… CVSS 3.1HIGH 7.5
Sources
- CVE-2026-29000 · CVE Program
- CVE-2026-29000 · NVD
- FIRST EPSS
- GHSA-pm7g-w2cf-q238 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences