Authentication Bypass in pac4j-jwt via Forged JWE/PlainJWT Claims

A maximum-severity authentication bypass was disclosed in pac4j’s JWT component (pac4j-jwt), tracked as CVE-2026-29000, affecting a widely used Java security engine embedded across many downstream software packages. The issue is a logic flaw that enables attackers to bypass authentication controls by crafting tokens/claims in a way that defeats expected verification, raising concern because exploitation can be relatively straightforward and the library’s transitive use complicates exposure tracking and patch rollout across dependent applications.

Public proof-of-concept (PoC) code is available, and reporting indicates an attacker who can obtain a target server’s RSA public key (often publicly accessible) can forge a JWE-wrapped PlainJWT containing arbitrary sub and role claims to bypass signature verification and authenticate as any user, including administrators. The pac4j maintainer disclosed the defect and released patched versions shortly after private reporting; while there were no confirmed in-the-wild exploits at the time of reporting, defenders should expect downstream vendors and application owners to issue their own advisories and updates as they assess inherited risk from bundled pac4j versions.