CVE-2026-29000

Name of the Vulnerable Software and Affected Versions pac4j-jwt versions prior to 4.5.9 pac4j-jwt versions prior to 5.7.9 pac4j-jwt versions prior to 6.3.3

Description The software contains an authentication bypass issue in the

JwtAuthenticator

component when handling encrypted JWTs. An attacker with access to the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, effectively bypassing signature verification and gaining unauthorized access, including administrative privileges.

Recommendations Update pac4j-jwt to version 4.5.9 or later. Update pac4j-jwt to version 5.7.9 or later. Update pac4j-jwt to version 6.3.3 or later.