CVE-2026-29000

CVE-2026-29000: pac4j JWT-Authentifizierungs-Umgehung PoC Proof of Concept für CVE-2026-29000 – Eine kritische Authentifizierungs-Umgehungsschwachstelle in der pac4j-JWT-Implementierung, die es Angreifern ermöglicht, Admin-Token ohne gültige Signatur zu fälschen. ⚠️ HAFTUNGSAUSSCHLUSS Dieses Tool...

CVE-2026-29000

CVE-2026-29000 Lab Laboratorio Java/SparkJava che simula un errore di autenticazione JWT/JWE relativo a CVE-2026-29000. L'applicazione gira sulla porta 4567 e fornisce API per testare il flusso di login valido, creare token falsificati e controllare la dashboard. Informazioni CVE CVE-2026-29000...

CVE-2023-25581

Questo script Python dimostra lo sfruttamento della vulnerabilità CVE-2023-25581 in pac4j-core. La vulnerabilità consente a un attaccante di eseguire codice arbitrario RCE deserializzando dati codificati in Base64 creati malevolmente. Prerequisiti Prima di eseguire lo script, assicurati di avere...

CVE-2026-29000-PoC

CVE-2026-29000 — Prova de Conceito de Bypass de Autenticação do JwtAuthenticator do pac4j-jwt Uma prova de conceito para CVE-2026-29000 , um bypass de autenticação no componente pac4j-jwt JwtAuthenticator CVSS 10.0 , Crítico. O script forja um token que se passa por qualquer usuário com qualquer...

CVE-2026-29000-PoC-Exploit

🚀 CVE-2026-29000 - Exploit di Bypass dell'Autenticazione pac4j-jwt CVE-2026-29000 - Creazione Admin con un Click tramite JWT alg:none + Crittografia JWE 📌 Panoramica Questo exploit sfrutta CVE-2026-29000 , una vulnerabilità critica con CVSS 10.0 nella libreria pac4j-jwt. Estratta la chiave...

CVE-2026-40458

PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...

CVE-2026-40459

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

Exploit for CVE-2026-29000

Lab Demo CVE-2026-29000: pac4j-jwt Authentication Bypass Môi...

Exploit for CVE-2026-29000

CVE-2026-29000: pac4j JWT Authentication Bypass PoC Proof...

Exploit for CVE-2026-29000

🚀 CVE-2026-29000 - pac4j-jwt Authentication Bypass Exploit !...

Exploit for CVE-2026-29000

HackTheBox — Principal Difficulty: Medium OS: Linux...

Exploit for CVE-2026-29000

pac4j-jwe-forge CVE-2026-29000 Proof-of-concept for CVE-202...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection in the LdapProfileService class, which accepts ID-based search parameters in multiple methods. A privileged attacker can execute unauthorized LDAP queries and perform arbitrary directory operations. Remediation Upgrade...

EUVD-2026-23423

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

GHSA-XW5C-JC7X-GF75 PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability

PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...

Cross-site Request Forgery (CSRF)

Overview org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF d...

CVE-2026-40459

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

CVE-2026-40458

PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...

CVE-2026-40459

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

CVE-2026-40459 LDAP Injection in PAC4J

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...