CVE-2026-29000

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 6.17%
EPSS Percentile: 93.53%
CISA KEV: Not listed

Description

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 05-Mar-2026 05:16
Last Modified: 08-Oct-2026 23:17
EPSS Date: 2026-11-06
CWE: CWE-347

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

pac4j · pac4j-jwt Source: CNA · [email protected]
Default status: unaffected

4.0 ≤ version < 4.5.9 — affected (custom)
5.0 ≤ version < 5.7.9 — affected (custom)
6.0 ≤ version < 6.3.3 — affected (custom)

packageURL: pkg:maven/org.pac4j/pac4j-jwt
repo: https://github.com/pac4j/pac4j

References

Last enrichment sync: 07-Nov-2026 02:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Critical JWT signature validation flaw in Pac4j (CVE-2026-29000) allowed authentication bypass by manipulating public-key interpretation. Sysdig’s March 2026 Briefing Tracks Rapid Exploitation and TeamPCP Supply-Chain Attacks

CVE (4)

People (1)

Threat Actors (1)

MITRE ATT&CK (5)

Vendors (8)

Products (10)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.