CVE-2026-29000

CVE-2026-29000: pac4j-jwt JwtAuthenticator 인증 우회 전체 구성: 분석 문서writeup, Java 인프로세스 PoC, Python 토큰 위조 CLI 및 라이브러리, 테스트. 요약 CVE: CVE-2026-29000 CVSS 10, CWE-347 영향 범위: JWE + 서명 구성을 사용하는 pac4j-jwt 4.5.9 / 5.7.9 / 6.3.3 문제점: JWE로 래핑된 PlainJWT서명 없음가 서명 검증을 우회합니다. 공격자는 서버의 RSA 공개 키만 있으면 토큰을 위조하고 임의의 사용자로...

cve-2026-29000

CVE-2026-29000 익스플로잇 pac4j-jwt의 JWE로 래핑된 PlainJWT를 통한 JWT 인증 우회 취약점 설명 CVE-2026-29000은 pac4j-jwt 4.5.9, 5.7.9, 6.3.3 이전 버전에 영향을 미치는 심각한 인증 우회 취약점입니다. 이 취약점으로 인해 원격 공격자가 인증 토큰을 위조하고 서명 검증을 우회할 수 있습니다. 기술적 세부 사항 이 취약점은 암호화된 JWTJWE를 처리할 때 JwtAuthenticator 구성 요소에 존재합니다. JWE 토큰이 수신되면: 1. 서버는 RSA 개인 키를...

CVE-2026-29000

JWT/JWE 인증 우회 PoC JWTJSON Web Token와 JWEJSON Web Encryption를 사용하여 인증 우회 취약점을 시연하는 PoCProof-of-Concept 스크립트입니다. 이 도구는 토큰 알고리즘을 부적절하게 검증하여 유효한 JWE 구조에 래핑된 검증되지 않은 JWTalg: none를 수락하는 환경을 악용합니다. 작동 방식 이 공격 체인은 일반적인 암호화 구현 결함을 이용합니다. 1. 키 추출: 스크립트는 대상의 공개적으로 노출된 jwksJSON Web Key Set 엔드포인트에 연결하여 서버의 공개...

Linux Distros Unpatched Vulnerability : CVE-2026-102271

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because asymmetric-key guard...

Linux Distros Unpatched Vulnerability : CVE-2026-102268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize...

Linux Distros Unpatched Vulnerability : CVE-2026-102272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JW...

AZL-105224 CVE-2026-102272 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

DEBIAN-CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

DEBIAN-CVE-2026-102271

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and...

AZL-105227 CVE-2026-102273 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

AZL-104991 CVE-2026-102268 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

DEBIAN-CVE-2026-102268

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

CVE-2026-102268

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

CVE-2026-102268

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

UBUNTU-CVE-2026-102271

PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and...

UBUNTU-CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with ...

UBUNTU-CVE-2026-102268

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, ispemformat in jwt/utils.py is affected because ispemformat does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and...