CVE-2026-29000-PoC

CVE-2026-29000 — Bypass de autenticación en JwtAuthenticator de pac4j-jwt — PoC Una prueba de concepto para CVE-2026-29000 , un bypass de autenticación en el componente pac4j-jwt JwtAuthenticator CVSS 10.0 , Crítico. El script forja un token que suplanta a cualquier usuario con cualquier rol — si...

CVE-2026-29000

Laboratorio CVE-2026-29000 Laboratorio Java/SparkJava que simula el error de autenticación JWT/JWE relacionado con CVE-2026-29000. La aplicación se ejecuta en el puerto 4567 y proporciona APIs para probar flujos de inicio de sesión válidos, generar tokens falsificados y verificar el panel de...

CVE-2026-63408: Use of GET Request Method With Sensitive Query Strings

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the JwtAuthenticator component when handling encrypted JWTs. An attacker can gain unauthorized access by crafting a JWE-wrapped PlainJWT with arbitrary claims if they possess the...

CVE-2026-29000

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT wi...

pac4j-jwt 数据伪造问题漏洞

pac4j-jwt is an JWT authentication module developed by pac4j as open source. Versions of pac4j-jwt prior to 4.5.9, 5.7.9, and 6.3.3 contained a data manipulation vulnerability. This vulnerability stems from the JwtAuthenticator’s inability to properly handle encrypted JWTs, leading to an...

CVE-2026-29000: Improper Verification of Cryptographic Signature

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT wi...