SB2026030924 - Authentication bypass in pac4j

Description

This security bulletin contains information about 1 vulnerability.

1) Improper verification of cryptographic signature (CVE-ID: CVE-2026-29000)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/U:Red

The vulnerability allows a remote attacker to bypass authentication checks.

The vulnerability exists due to an error in JwtAuthenticator when processing encrypted JWTs. A remote non-authenticated attacker with possession of the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypass signature verification and authenticated as any user including administrators.

Remediation

Install update from vendor's website.

References

• https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key
• https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html
• https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass