CVE-2023-25581

This Python script demonstrates the exploitation of the CVE-2023-25581 vulnerability in pac4j-core. The vulnerability allows an attacker to execute arbitrary code RCE by deserializing maliciously crafted Base64-encoded data. Prerequisites Before running the script, make sure you have the followin...

CVE-2026-29000

CVE-2026-29000 — pac4j-jwt JWE Authentication Bypass CTF lab for researching the JWE authentication vulnerability in the pac4j-jwt library CVSS 9.3 Critical · CWE-287 · Affected: pac4j-jwt ← access admin panel ↓ Read sensitive data: employee list, system config, flag Project structure...

CVE-2026-29000

CVE-2026-29000: Proof of Concept PoC for pac4j-jwt Auth Bypass ⚠️ Disclaimer This tool is for educational and ethical security testing purposes only. I do not and will not support threat acting in any way, shape or form. Use at your own risk. This is also my first PoC, so be nice please. This is...

CVE-2026-29000

CVE-2026-29000 Exploit Generator Rust This repository contains a specialized Rust implementation for exploiting CVE-2026-29000, an authentication bypass vulnerability in pac4j-jwt. The vulnerability stems from a "Signature Validation Skip" when a PlainJWT alg: none is nested within an encrypted J...

CVE-2026-29000

Simple script that exploits CVE-2026-29000. All you need is the public key in the PEM format and you can use this. For more info on the vulnerability read: https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key...

cve-2026-29000

CVE-2026-29000 Exploit JWT Authentication Bypass in pac4j-jwt via JWE-wrapped PlainJWT Vulnerability Description CVE-2026-29000 is a critical authentication bypass vulnerability affecting pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability allows remote attackers to forge...

CVE-2026-29000

CVE-2026-29000 CVE-2026-29000: Critical Authentication Bypass in pac4j-jwt - Using Only a Public Key CVSS 10 pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 Vulnerability Summary CVE-2026-29000 is a critical authentication bypass in the pac4j-jwt library versions 6.0.3 and below. When the...

CVE-2026-29000

CVE-2026-29000 A proof of concept script for CVE-2026-29000, a critical authentication bypass vulnerability found in the pac4j-jwt library DISCLAIMER This Proof of Concept is for educational and ethical security testing purposes only. It was developed to demonstrate the technical root cause of...

CVE-2026-29000-pac4j-jwt-auth-bypass

HTB Principal — CVE-2026-29000 Writeup Disclaimer: This exploit was developed solely for the retired HackTheBox machine "Principal". For educational purposes only. Do not use against systems you do not own or have explicit permission to test. Machine Info Field| Details ---|--- Name| Principal...

CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc

CVE-2026-29000 – pac4j JWT Authentication Bypass Python PoC Python Proof‑of‑Concept for CVE‑2026‑29000 , a critical authentication bypass affecting applications using the pac4j JWT module. The vulnerability allows attackers to authenticate as arbitrary users by sending a malicious JWE token...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt JwtAuthenticator authentication bypass Full buildout: writeup, Java in-process PoC, Python token-forge CLI and library, tests. Summary CVE: CVE-2026-29000 CVSS 10, CWE-347 Affected: pac4j-jwt 4.5.9 / 5.7.9 / 6.3.3 when using JWE + signature config Issue: JWE-wrapped...

pac4j-check

pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...

CVE-2026-29000-PoC-Exploit

CVE-2026-29000 - pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 - One-Click Admin Forge via JWT alg:none + JWE Encryption Overview This exploit weaponizes CVE-2026-29000 , a critical CVSS 10.0 vulnerability in the pac4j-jwt library. By extracting the server's public JWKS key and forging a...

CVE-2026-29000-PoC

CVE-2026-29000 — pac4j-jwt JwtAuthenticator Authentication Bypass PoC A proof-of-concept for CVE-2026-29000 , an authentication bypass in the pac4j-jwt JwtAuthenticator component CVSS 10.0 , Critical. The script forges a token that impersonates any user with any role — without knowing a single...

CVE-2026-29000

CVE-2026-29000: pac4j JWT Authentication Bypass PoC Proof of Concept for CVE-2026-29000 - A critical authentication bypass vulnerability in pac4j JWT implementation that allows attackers to forge admin tokens without a valid signature. ⚠️ DISCLAIMER This tool is provided for educational and...

CVE-2026-29000

CVE-2026-29000 Lab Java/SparkJava lab simulating JWT/JWE authentication vulnerability related to CVE-2026-29000. The application runs on port 4567 and provides APIs to test valid login flow, forge tokens, and check dashboard. CVE Information CVE-2026-29000 affects pac4j-jwt in versions prior to...

CVE-2026-29000-Lab

CVE-2026-29000 — pac4j-jwt Library-Level PoC Lab TL;DR This repository contains a library-level PoC for CVE-2026-29000 in pac4j-jwt. It compares vulnerable and patched behavior with two cases: Baseline : a legitimate token should be accepted Attack : a forged token should be accepted on vulnerabl...

CVE-2026-29000-pac4j-jwt

pac4j-jwe-forge CVE-2026-29000 Proof-of-concept for CVE-2026-29000. Targets pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability is straightforward: the library accepts a PlainJWT unsigned, alg=none as long as it's wrapped inside a valid JWE. Since the server exposes its RSA...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt Authentication Bypass POC This repository contains a proof-of-concept POC for an authentication bypass vulnerability in pac4j-jwt CVE-2026-29000. The vulnerability allows an attacker to bypass signature verification by nesting a PlainJWT using alg: none inside a JWE JSON...

CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC

CVE-2026-29000 - pac4j-jwt Authentication Bypass PoC Note: This is not my original work. I am keeping this here for a reference. Working methodology: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admin, role=ROLEADMIN + Forged JWE...