CVE-2026-29000-PoC

CVE-2026-29000 — pac4j-jwt JwtAuthenticator Authentication Bypass PoC A proof-of-concept for CVE-2026-29000 , an authentication bypass in the pac4j-jwt JwtAuthenticator component CVSS 10.0 , Critical. The script forges a token that impersonates any user with any role — without knowing a single...

CVE-2026-29000-PoC-Exploit

🚀 CVE-2026-29000 - pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 - One-Click Admin Forge via JWT alg:none + JWE Encryption 📌 Overview This exploit weaponizes CVE-2026-29000 , a critical CVSS 10.0 vulnerability in the pac4j-jwt library. By extracting the server's public JWKS key and...

pac4j-check

pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...

CVE-2023-25581

This Python script demonstrates the exploitation of the CVE-2023-25581 vulnerability in pac4j-core. The vulnerability allows an attacker to execute arbitrary code RCE by deserializing maliciously crafted Base64-encoded data. Prerequisites Before running the script, make sure you have the followin...

CVE-2026-29000

CVE-2026-29000: pac4j JWT 認証バイパス PoC 概念実証 CVE-2026-29000 - pac4j JWT 実装における重大な認証バイパス脆弱性。攻撃者は有効な署名なしで管理者トークンを偽造できます。 ⚠️ 免責事項 このツールは教育目的および許可されたセキュリティテスト目的のみに提供されています。作者はこのエクスプロイトの誤用、損害、または違法使用について一切の責任を負いません。 コンピュータシステムへの不正アクセスはほとんどの法域で違法 です テスト前に明示的な書面による許可 を取得する必要があります...

CVE-2026-29000

CVE-2026-29000 Lab Java/SparkJava lab simulating JWT/JWE authentication vulnerability related to CVE-2026-29000. The application runs on port 4567 and provides APIs to test valid login flow, forge tokens, and check dashboard. CVE Information CVE-2026-29000 affects pac4j-jwt in versions prior to...

CVE-2026-29000-pac4j-jwt

pac4j-jwe-forge CVE-2026-29000 Proof-of-concept for CVE-2026-29000. Targets pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability is straightforward: the library accepts a PlainJWT unsigned, alg=none as long as it's wrapped inside a valid JWE. Since the server exposes its RSA...

CVE-2026-29000

CVE-2026-29000 CVE-2026-29000: Critical Authentication Bypass in pac4j-jwt - Using Only a Public Key CVSS 10 pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 Vulnerability Summary CVE-2026-29000 is a critical authentication bypass in the pac4j-jwt library versions 6.0.3 and below. When the...

CVE-2026-29000-Lab

CVE-2026-29000 — pac4j-jwt Library-Level PoC Lab TL;DR This repository contains a library-level PoC for CVE-2026-29000 in pac4j-jwt. It compares vulnerable and patched behavior with two cases: Baseline : a legitimate token should be accepted Attack : a forged token should be accepted on vulnerabl...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt Authentication Bypass POC This repository contains a proof-of-concept POC for an authentication bypass vulnerability in pac4j-jwt CVE-2026-29000. The vulnerability allows an attacker to bypass signature verification by nesting a PlainJWT using alg: none inside a JWE JSON...

CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC

CVE-2026-29000 - pac4j-jwt Authentication Bypass PoC Note: This is not my original work. I am keeping this here for a reference. Working methodology: root@kitploit: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admin, role=ROLEADM...

CVE-2026-29000

CVE-2026-29000：pac4j-jwt JwtAuthenticator 身份验证绕过 完整构建：writeup、Java 进程内 PoC、Python 令牌伪造 CLI 和库、测试。 摘要 CVE： CVE-2026-29000（CVSS 10，CWE-347） 受影响版本： 使用 JWE + 签名配置时的 pac4j-jwt 4.5.9 / 5.7.9 / 6.3.3 问题： JWE 包装的 PlainJWT （未签名）绕过签名验证；仅拥有服务器 RSA 公钥 的攻击者即可伪造令牌并以任意用户身份进行身份验证。 有关详细信息和 PoC 要求，请参阅 WRITEUP.md。 ...

CVE-2026-29000

CVE-2026-29000 针对 CVE-2026-29000 的概念验证脚本，该漏洞是 pac4j-jwt 库中发现的一个严重身份验证绕过漏洞 免责声明 本概念验证仅用于教育和道德安全测试目的。其开发目的是在 HackTheBox 实验室环境中演示 CVE-2026-29000 的技术根本原因。 未经授权访问计算机系统属于违法行为。本仓库作者不对任何滥用此信息的行为负责，也不对因使用此脚本造成的任何损害负责。请仅在您拥有或已获得明确书面许可测试的系统上使用此工具。别犯傻。 分析 一个公共端点暴露了 RSA 公钥，使我们能够构造带有任意角色的 JWE 包装...

CVE-2026-29000-pac4j-jwt-auth-bypass

HTB Principal — CVE-2026-29000 Writeup Disclaimer: This exploit was developed solely for the retired HackTheBox machine "Principal". For educational purposes only. Do not use against systems you do not own or have explicit permission to test. Machine Info...

CVE-2026-29000

CVE-2026-29000 — pac4j-jwt JWE Authentication Bypass CTF lab for researching the JWE authentication vulnerability in the pac4j-jwt library CVSS 9.3 Critical · CWE-287 · Affected: pac4j-jwt ← access admin panel ↓ Read sensitive data: employee list, system config, flag Project structure...

CVE-2026-29000

CVE-2026-29000: Prueba de Concepto PoC para la Omisión de Autenticación en pac4j-jwt ⚠️ Aviso Legal Esta herramienta es únicamente para fines educativos y de pruebas de seguridad ética. No apoyo ni apoyaré el ciberdelito de ninguna manera, forma o modo. Úsala bajo tu propio riesgo. Este es también...

CVE-2026-29000

CVE-2026-29000 Exploit Generator Rust This repository contains a specialized Rust implementation for exploiting CVE-2026-29000, an authentication bypass vulnerability in pac4j-jwt. The vulnerability stems from a "Signature Validation Skip" when a PlainJWT alg: none is nested within an encrypted J...

cve-2026-29000

CVE-2026-29000 漏洞利用 通过 JWE 包装的 PlainJWT 绕过 pac4j-jwt 中的 JWT 身份验证 漏洞描述 CVE-2026-29000 是一个严重的安全绕过漏洞，影响 pac4j-jwt 4.5.9、5.7.9 和 6.3.3 之前的版本。该漏洞允许远程攻击者伪造身份验证令牌并绕过签名验证。 技术细节 该漏洞存在于处理加密 JWT（JWE）时的 JwtAuthenticator 组件中。当收到 JWE 令牌时： 1. 服务器使用其 RSA 私钥解密 JWE 2. 解密后的内容显示一个内部 JWT 3. 漏洞 ：服务器提取内部 JWT 中的声明，但未验证其...

CVE-2026-29000

Simple script that exploits CVE-2026-29000. All you need is the public key in the PEM format and you can use this. For more info on the vulnerability read: https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key...

Principal-HackTheBox

HackTheBox — Principal Difficulty: Medium OS: Linux Platform: HackTheBox Overview Web application running pac4j-jwt v6.0.3 — vulnerable to CVE-2026-29000. The public RSA key is exposed unauthenticated via a JWKS endpoint and can be used to forge a valid admin JWE token, bypassing authentication...