Critical pac4j-jwt Authentication Bypass Lets Attackers Impersonate Any User

A critical vulnerability in the widely used Java authentication library pac4j-jwt exposes applications to total authentication bypass, enabling attackers to impersonate any user, including admins.

Tracked as CVE-2026-29000, it scores a perfect 10.0 on the CVSS scale, making it one of the most severe flaws in recent open-source history.

Remote attackers need only the server’s public RSA key to exploit it; no private keys, passwords, or secrets are required.

Discovered by the CodeAnt AI Security Research Team during routine open-source code audits, the flaw allows forging JSON Web Tokens (JWTs) with fake claims.

Their automated tools spotted how attackers could craft these tokens to evade signature checks entirely. This affects countless Java apps relying on pac4j-jwt for secure logins, from enterprise systems to web services.

How the Bypass Works

Pac4j-jwt normally protects tokens with dual layers: encryption hides the data, and a digital signature proves authenticity.

When a server gets a token, it decrypts the outer envelope first, then verifies the inner signature using the private key counterpart to the public one.

The exploit hinges on a clever trick: attackers create an unsigned “PlainJWT” token, pack arbitrary claims like “admin: true,” and encrypt it solely with the server’s public RSA key, freely available in most setups.

The library then mishandles this during parsing. Instead of flagging the missing signature, a flawed null check skips the verification block entirely.

Picture it like a bank vault with two locks. The outer lock (encryption) opens fine with the public key, but the inner lock (signature) gets ignored because the system glitches on “no signature detected.”

The server trusts the claims blindly, granting full access. No alarms, no rejection, just instant impersonation.

This strikes RSA-encrypted JWT setups using JwtAuthenticator, common in secure Java apps. Attackers can grab the public key from endpoints or configs, craft the token in seconds, and deploy it via tools like jwt.io.

Credit to maintainer Jérôme Leleu for lightning-fast action. After private disclosure, patches were rolled out in two business days. Vulnerable versions include pac4j-jwt 4.x before 4.5.9, 5.x before 5.7.9, and 6.x before 6.3.3.

Immediate steps:

• Update dependencies via Maven/Gradle to patched releases.
• Scan code for mixed encryption-signature configs in JwtAuthenticator.
• Test with crafted unsigned tokens to confirm fixes.
• Monitor logs for anomalous JWTs lacking signatures.

Security teams should prioritize this, as exploitation requires minimal skill. Read the full advisory from CodeAnt AI and check your package manager now.

In a world of rising JWT abuse, this underscores why dual defenses demand bulletproof implementation.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.