CVE-2026-29000: Authentication Bypass in pac4j-jwt

CVE-2026-29000 identifies an authentication bypass vulnerability in the JwtAuthenticator component of pac4j-jwt, a widely used library for JWT handling in Java applications. The flaw affects versions prior to 4.5.9, 5.7.9, and 6.3.3. Remote attackers possessing the server's RSA public key (often publicly exposed) can construct JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification controls and authenticating as administrators without valid credentials.

The vulnerability has a CVSS 9.1 score in the critical category. It was published on NVD on 2026-03-04 and continues to receive attention: as of 2026-10-30, public repositories have announced availability of educational proof-of-concept for signature bypass on JWE-wrapped JWT specifically for pac4j-jwt. Official patches have been available for months, but failure to systematically update remains high in many legacy environments.

For defenders, immediate priority is identifying all instances of pac4j-jwt in use and checking their version. Update immediately to 4.5.9, 5.7.9, or 6.3.3. In parallel, audit authentication logs from months prior to patching to detect JWT tokens with anomalous claims or unexplained administrative authentications. Verify that RSA public keys are not exposed in historical Git repositories or accessible configurations. Continuously monitor logs for forged JWT patterns during patch rollout in production systems, where impact is maximum.